When Does Website Monitoring Go Too Far? 259
"Though I believe they are a reputable company, they are doing some things I do not think are good: checking for the domain names on the TLD servers once per second, downloading various files from the site once per second, and sending email to themselves once per second.
Our first response was to talk to them and explain what we needed them to do, including a list of IPs that we used for customers so they could adjust their monitoring to suit what we thought was reasonable. They chose to ignore the first discussion and continued to abuse the servers. After the email server required a half-day of cleanup, the CTO simply shut them off at the firewalls. Rather than using the contact information they had, they chose to complain to our mutual customers instead. (I should note we do significant monitoring of the servers ourselves, and typically know if something is wrong within minutes of the event.)
Is this typical behavior of monitoring service companies? I know some of them are not reputable at all (due to spamming) however these guys seem to know what they are doing, and yet managed to effectively attack our mail and web servers, as well as doing some things I would not do to the TLD servers. It is hard to feel justified to shutting off someone else's cash-flow, but at the same time we need to defend servers from over zealous monitoring."
How about enforcing a time-based rule? (Score:5, Insightful)
Re:How about enforcing a time-based rule? (Score:5, Insightful)
Re:How about enforcing a time-based rule? (Score:4, Informative)
Re:How about enforcing a time-based rule? (Score:5, Insightful)
I work in a network shop that provides connectivity to remote buildings on our campus. Each building has a psuedo-network admin. Usually a second job that some paper-pusher takes to get in good with his boss. By default, the building admin has his home page set to a MRTG log showing every switch in his building. They are trained to look for network spikes on user's ports and notify us so we can disable that port, if nescessary. He can also monitor everything from fan speed to temprature setings on his router and the core router for our remote users.
Re:How about enforcing a time-based rule? (Score:4, Insightful)
Don't tell me you've never gotten an irate message from some idiot out on the net who installed poorly-configured personal firewall software and says "I went to your website and it tried to hack my computer on port 80!"
Sharing information is, in general, a Good Thing. But if they don't have an understanding of how to apply the information in proper context, it can do a lot more harm than good.
Re:How about enforcing a time-based rule? (Score:3, Interesting)
not to mention, it's probably already quite possible for your users to find out you were down for 30 seconds or so; even if they don't know it was cause the ceo tripped over a network cable, and knocked some network equipment down
Re:How about enforcing a time-based rule? (Score:5, Interesting)
So it's got all these options, and I wasn't paying attention, so I just said, "Monitor EVERYTHING...At 5 sedcond intervals."
Fortunately, I'm not a complete idiot, and it only filled up the directory I'd set for it, not the whole harddrive, but it did teach me an important lesson about log files: You can get a gig of useless information in less than an hour, OR you can monitor the IMPORTANT stuff, and get a gig of useful information in 2 or 3 days.
In case anyone is wondering, my logs proved 2 things: 1) That they needed a new database server and 2) That the people who were bitching about it being slow ALL the time, were actually only working about an hour a day.
The obvious answer (Score:5, Insightful)
Or better yet... (Score:5, Interesting)
Make sure they know that cleaning up logs should be *cough* easy and pain free!
Re:Or better yet... (Score:3, Insightful)
p.s. Why is using perl funny?
Lousy sysadmins (Score:3, Insightful)
How about partitioning your servers properly so they don't crash when they fill the logs?
Basic sysadmin 101, people. You're going to piss off customers by doing what the parent suggests.
Log partitioning (Score:3, Informative)
Re:Log partitioning (Score:5, Informative)
I also suggest anyone running servers to have some sort of program monitoring disk usage. If the disk gets dangerously low on space it should notify staff and take action such as rotating logs. Have the server page an admin or set an alarm off (where it'll be noticed) or something. Whatever you'd do if an attempted intrusion was detected. I usually have the server send warnings at 90% and 95% and at about 97% usage it should give me a good loud yell.
Something smells fishy here (Score:5, Insightful)
$ units bits/second bits/day
* 86400
So you're looking at (roughly) 100K hits per day per file downloaded per site. If they're downloading 15 files per site, and you've got 100 sites on the box, then you're looking at an increase of about 120 million requests per day. My acess log has an average of 200bytes/er line, so you're now looking at 120Mrequests*200bytes/request == a sudden jump of 24gigabytes of logging per day.
Then you've got the effective mail-bombing to deal with.
The article author said that these people sounded like they know what they're doing, so that leaves (in my mind), two likely possibilities:
- They're really really good snow-job artists. They understand the terminology, but they have no real sense of methodology or purpose.
- They really do know what they're doing, and they're trashing your servers with intent.
I mean -- for crying out loud: Multiple files once per second? And just how long did it take them to inform your customers that they'd managed to crash the servers? Monitoring granularity of more than about one quarter the normal notification time is a complete waste of resources -- and that's giving them lots of leeway to waste.And Tens of thousands of undelivered emails??? If those emails didn't get delivered, then what did the company do when they didn't arrive in short order? Why didn't they stop the transmission and diagnose why the emails weren't coming thru? If the emails really are undeliverable, then how in the world did you manage to conclude that they know what they're doing?
Other notes (mostly mentioned elsewhere)
-
are you charging your customers based on their net volume? If so, have you informed your customers of what sort of costs these, uhm, people are imposing on them in addition to their monitoring fees?
- I'm guessing that your AUP includes a clause on activities that wilfully or negligently cause inappropriate server load, outages, etc. I think that this company's "services" classifies.
- I think that you had better seriously consider possibility #2 above. Meticulously document what they've done to your servers (including somehow scamming your customer list). Have that information ready to present to your customers and/or a judge. If all goes well, you won't need it, but I'm not expecting all to go well, given how they've gone so far.
One last point -- Even though you may be dealing with a company that you think has a (otherwise) good reputation, doesn't mean that you're not dealing with an inept department of an otherwise good company. Sometimes the VP Engineering puts his/her stupid cousin in some group where they're not likely to do much damage, and then finds out that the goofball has managed to get out 'in the wild' with a 'bright' idea.Depends on how (Score:4, Informative)
And they shouldn't be keeping the logs on the server anyway. It's static data that only they could need access to. It should be moved off site to a standard IDE harddrive for processing.
Statistical data should be created as the data comes in and not from the log files if they intend to let the customers have statistics for whatever.
As for my own site, I have Apache doing the combined log format and wrote custom software to process and analyze the data. Every month I move the log off the server and every 10 megs or so I rotate the logs and move the data into a second cumulative file that Apache doesn't work off of.
Ben
OVERKILL, is what it is. (Score:4, Insightful)
Re:OVERKILL, is what it is. (Score:4, Insightful)
Sometimes services can lock up to the point where they are not functioning without closing down the port. Something slightly more thurough like nagios [nagios.org] should do nicely. ie: Does a simple http request and confirms the reply is ok.
Gotta love Verio (Score:2)
DOH ! gotta stop smoking weed .. (Score:3, Funny)
And SITEFINDER instead of seeker. dammit
Now why didn't i pressed preview ?
Re:OVERKILL, is what it is. (Score:4, Insightful)
Re:OVERKILL, is what it is. (Score:5, Interesting)
At one of the companies I worked for, we had a pretty large farm of web servers running, and some hefty database servers on the backend. Not to mention all the support servers; running specific tasks. Some scheduled, some triggered.
For our web application, ping wasn't enough. Sure, the server would be running, but since the application wasn't coded in pure html, we needed to make sure it was actually working.
We set up scripts to test the functionality of various application functions. We also had to monitor all the web servers and database servers individually. We also had to monitor the "service status" of the entire system; ie two web servers can fail and it's not an emergency - but if the application is not functioning through the load balancer, it was.
Ping doesn't always cut it. With any somewhat complicated web application you need to monitor the functionality of the application, not just the server.
To add, 5 minutes is a big deal. If you have a web application that's heavily used and with paying customers, it's important for you to be up and running. If something unfortunate should happen, you need to know right away. We had some of the simple checks running every 2 minutes, and some of the more intensive checks running every 3.
Obviously, running a check every second is ridiculous, especially if it's something dumb like TLD servers. An hourly check on that would be more then enough because you can't fix it quickly anyways. Not to mention that you must be aware of the monitoring system in place and make sure your servers won't choke from it. Make sure you have enough log space. Make sure you're not affecting application performance from monitoring.
Re:OVERKILL, is what it is. (Score:2)
Sometimes you need more checks then ping.
And ping (on the local network) is usually a good indication of when a box is totally non-responsive. Of course, icmp should be throttled/blocked at the border router.
Confidentiality (Score:5, Insightful)
Sounds like you've got an open and shut legal case to recoup those costs they're causing you to incur.
Re:Confidentiality (Score:5, Interesting)
Be very clear to your customers that your objection is the nearly-criminal (it's a DOS) heavy-handedness, mind-numbingly unethical and pathetically incompetent behavior of the monitoring company. It's not unreasonable for one of your customers to retain a third party to provide professional services of this nature; by professional I mean 'do it right' not in the sense of professional as a term of law. Loading your website at regular intervals and parsing their logs for them is fine. Right now, these guys are probably reporting the outages they caused.
Billing your clients for bandwidth used by the monitoring company they hired is not completely unreasonable. Be sure to document every cost associated with this in every way, including time reading responses to this article as 'best practices research'. I'm not kidding, if you worked late you add the pizza in or the taxi home. Every penny in fine detail. Your lawyer will be keenly intereste, so might law enforcement if the polite C&D letter didn't do it.
Since the offered protection, aka monitoring services and then caused damage to your systems you could make a case that a protection racket is being run. If, adding in their fees for their services (paid by your customers) to the damages calculated above you have more than a certain threshold, probably US$50,000, then the FBI will be interested. Also have the monthly and annual total of your revenue from the customers either employing the monitoring service plus those affected by the damage cause (probably all of them). If things go sour with them and you do go to law enforcement, wave your revenue totals around to help get DAs and FBI interested.
Basically, you call your lawyer and then contact your customers. Your lawyer asks them to behave themselves. Then you meet with the lawyer, discuss the response and post another Ask Slashdot.
Re:Confidentiality (Score:5, Interesting)
The customers should have run up huge bandwidth bills by causing their traffic to suddenly multiply by thousands with the auto-checking for site defacement (trans: re-spidering their site at an insane rate), and that'd be the way to recoup costs and then come off as the good guys by waiving thousands in excess fees...
Re:Confidentiality (Score:2)
Not bloody likely. It's like signing up for a massage, and complaining that you signed up for a massage when a heavyweight boxer shows up to pound the crap out of you.
Even though it's not stated in the article, the author is apparently employed by a web hosting firm, based on the ip space walking comment. If their TOS with their customers doesn't limit w
Re:Confidentiality (Score:2)
Re:Confidentiality (Score:2, Interesting)
C&D what? Block them entirely with firewalling, that's your right. But lawyering this, you're asking for trouble. The very nature of TCP protocol is that THEY ask for info, the ISP network acknowledges and then GIVES them the correlated data. Absolutely nothing illegal here. The ISP defaulted and let them in.
As to billing your customers, how nice. The way I look at it, 2 companies screwed up and now you want the customer to pay. The ISP--hey, how about setting up
Re:Confidentiality & TOS & Abuse (Score:5, Informative)
First things first. These are your servers. Your network. I am assuming you have the standard abuse clause in your TOS. You need a lawyer.
Unfortunately, you are in a bad situation. They apparently have more resources than you, because they can bring your setup to it's knees. Not saying it's right, not saying it's fair.
A lookup of your TLDs each second makes sense if you are Yahoo! or Google. Their web monitoring levels don't appear to be reasonable. You already know the technical answer.
Personally, I would be worried about them stealing your customers. I mean the argument is going to be simple from their side. They will simply say, "hey look, their stuff folded under 'normal' monitoring, we have a hosting company we can 'recommend'" or they will just have the hosting company call them up out of the blue and ask if they are "unhappy" with thier current service..."oh, it goes down a lot"..."they can't handle simple monitoring"..."gee, that's a shame"..."well, we've worked with that monitoring company before, and we have never had any problems, in fact we routinely get 5 9s"...etc
Honestly, talk to legal, explain the potential situation, and have them make contact with the monitoring company. A couple of tortious interference this, and cease and desist that, will put the monitoring company on it's toes and maybe get them to leave your customers alone, or possible play nice with your servers. Notify your customers yourself and explain that they are being investigated by your legal team, etc.
Re:Confidentiality (Score:5, Informative)
1) Tortious interference with business relationships. The solicited the customers. They directly interfered with the business relationship by bringing the servers down by overzealous monitoring.
2) The outage was caused by the monitoring company. If just one customer leaves to another hosting company because of outages or what not, or if that customer lost business due to downtime. The damages are realizable.
I know what to do! (Score:5, Funny)
One word: (Score:5, Informative)
http://www.nagios.org/
Cheers
Stor
Re:One word: (Score:3, Informative)
Big Brother [bb4.com]
Both are good monitoring packages, it's up to personal preference really.
Re:One word: (Score:5, Informative)
Actually Nagios is a lot more powerful that BB (which really doesn't do all that much), and aisde from that Big Brother is not 'free' (often people just don't bother to read the Terms and Conditions and think it's free).
You can use BB with no charge to monitor certain systems, but if you provide certain types of services you are required to by a license, and these days most medium and large ISP's fall under this category.
Big Brother is amazingly basic, I don't understand why people get so excited about it (I could re-write it in a day, and I'm far from a rocket scientist). Nagios, in contrast, is a full network and service monitoring system, and would have been much more useful in this instance and you could have used it to more easily identify the source of the incoming traffic.
When Does Website Monitoring Go Too Far? (Score:2, Funny)
Kind of depends on how rapidly you can respond to a problem with something being monitored - obviously every second or even every minute is too rapid. Every hour sounds better.
Re:When Does Website Monitoring Go Too Far? (Score:3, Interesting)
What this really smells like is a webhost who oversold their server on the theory that everybody would never take their accounts to the promised limits at the same time, and then that's just what happened and the webhost got exposed as not being able to handle it...
We should have a nationwide lawyer database (Score:2, Funny)
And anyone who is a lawyer, is denied access to all computing systems.
for smaller companies... (Score:3, Interesting)
Ofcourse this doesn't do anything to fix the bad reputation they may have given you by flooding your servers, but its a quick and easy antidote against future problems.
hm (Score:5, Interesting)
Now, if you charge your customers based on gigs transferred, it seems like this would fill up their quota for the month quite quickly. What are your customers going to think when they get a large overcharge bill for the bandwidth? They signed up for the service after all.
If you aren't hosting for money, then you probably aren't able to profit from this monitoring companies actions in the same way, so I suggest you blackhole their ip's. Downloading files from your server once per second goes way beyong monitoring, and into the realms of denial of service(It crashed your server you say).
What I would do? Make a change to the aup for your service stating that customers that use monitoring services that abuse bandwidth will have their accounts revoked, or be charge for the excess bandwidth used. There's no reason in the world why these people need to hit your servers as often as they are.
If you are unable to do business with your servers being hammered, then I suggest blackholing the monitoring service's IP's. It's only sensible.
Re:hm (Score:2)
Then have logs auto-trimmed and firewall the stupid company until they stop requesting every minute. For the good of system stability.
I actually admin a couple of systems at work. Was upgrading from one RedHat version to the next late one night, and the system was down for a while. Got an e-mail from some random company the next day telling me t
monitoring (Score:5, Informative)
i've had some services set up for monitoring as low as 30 seconds, but those are specific cases.
obviously a 1 seconds check is WAY too low, not only it's a waste of bandwidth, it's prone to false positives. what happen when you have a slight delay in one of the core routers that cause your packet to get dropped/delayed by 1000ms ?
Re:monitoring (Score:5, Interesting)
If a company did this kind of thing, even if taken to court they could produce the logs that verify the artificial downtime in order to defend themselves against accusations of lying to customers. Then, when asked if their once-per-second monitoring could have been the cause of the problem in the first place, they could make some fanciful BS claims like "a good server should be able to handle that."
My apologies for spinning an entirely hypothetical, and possibly paranoid, scenario. This was the first thing to pop into my incredibly suspicious mind - plus, it has the makings of a good scam if it hasn't already been done. :)
Re:monitoring (Score:2)
If you have the money or this ends up in a court battle, use some cash to get an independant analysis. Don't get it from a friend or a colleague. Get it from a company that you have respect for (preferably in another nearby city). Have them either file a friend of the cour brief or a notarized statement suitable for submission as evidence. Considering the mistakes that are made in the legal system due to misunders
Bad practices all around... (Score:5, Insightful)
Jonah Hex
How much is too much? (Score:5, Interesting)
They are in the business of measuring Net availability. They should learn to set the scale on their instruments before they connect them to the circuit. And they should back off when availability drops because they might be the cause of the drop. If their traffic represents more than about 10x that caused by an individual customer, then as a "juror" I'd think they were being irresponsible.
You are in the business of supplying Net availability. You should install circuit breakers. Too many connection from one host/network? Start dropping packets. Too much raw incoming traffic from one source? Get on the horn quickly to the netadmin.
Your customers don't care who's at fault, they want what they paid for. But they can't expect miracles.
Re:How much is too much? (Score:3, Informative)
Re:How much is too much? (Score:4, Insightful)
Of course they can, and do. They won't get them, but that's different.
Definately excessive (Score:2)
I find it difficult to imagine that the unnamed monitoring company hasn't overstepped its bounds. Perhaps you should send a calm e-mail to your customers explaining the issue at hand. Compare the once-per-second monitoring to calling a call center every second to check that it still works, or perhaps walking in and out through the front door of a store just to check if it still works. Both things are fine in moderation, but every second is entirely too much.
The monitoring company may have crossed some
I work in network management... (Score:5, Interesting)
Re:I work in network management... (Score:2, Insightful)
My Take on This (Score:5, Insightful)
Lets put it this way.
You provide your customers a service. Part of that user agreement (This is doubly important in a shared server enviroment) that the customer cannot install any software/script/service that impacts the performance of the servers beyond what you say they can. Even the act of using 3rd party monitoring that is causing this problem is in violation of your AUP your customers are contractually binded to. Now I cant see your AUP but I hope there are provisions in there stating this.
Now as far as the 3rd party company goes. You need to have your legal department file a cease letter to them with a explanation of the problems they're causing and until things can be worked out they are not permitted to conduct business across your network.
You also need to notify your customers the actions you're taking on this company and why. Also pointing out your AUP/SLA's with them and the un acceptable behavior of the company that was selling them services. Tell them what you can monitor and explain what they really need.
In the assumption of a web/email then all you need to do is monitor the ports and maybe a script that will verify the email server is accepting connections on a minute basis. That's all you need for that setup. Also if they're allowed to telnet into the box (SSH I hope) then you'd also monitor the SSH port as well to ensure they can connect to their equipment.
If you're co-locating: Then I would suggest getting a Nagios setup running and sell some sort of monitoring to your customers. A good example would be the system that springboardhosting.com provides to their users. We use them as our colo partner and I've had no complaints. Though we only use the basic monitoring I do have advanced tools at the house and my laptop should I feel I need to watch any critical services. And I use webmin to monitor peer servers and page my phone in case there are any problems.
You're in a pickle at the moment but I think your customers will appreciate cutting off the source of the outages. Nobody needs to know if their service is up by the second unless it's some sort of huge database application and then you'd have special provisions to monitor it and not remotely.
That company is basically DDOS'g your servers to death. So it's basically them or you. I think the choice is simple
Hope that helps.
Don't let others eat off your plate. (Score:3, Informative)
Re:Don't let others eat off your plate. (Score:2)
It's obviously a service your customers want. It doesn't go down your network pipe, since all of the monitoring happens on your ethernet network. Firewall the monitoring service, but offer the same service *for free*, and you'll gain at least two things.
the adoration of your users, and you'll get the asshat monitori
I haven't been impressed with monitoring companies (Score:5, Interesting)
To some extent, that was fine with me. I'd been arguing for that for a very long time but had gotten nowhere because the "security expert" said that firewalls weren't necessary! I guess someone finally bothered to break into his system.
The security expert's idea was to have a third party monitoring company do it all. So I spent a couple hours on the telephone one day talking to the monitoring company's personnel about our network requirements and traffic. We went into great detail over exactly which servers had to handle which services.
The firewall arrived and the security expert plugged it in. It didn't work at all. All it did was block everything. I was 600 miles away at the time and it took me a week to convince them to take it off.
They decided the firewall was defective and the monitoring company set up another one. By the time it arrived, I was back in the office. The big day came and the security expert had one of his employees come out and plug it in.
It didn't work at all.
I caught the employee of the so-called security expert before he could leave the building and had him remove it. The idiot didn't even bother to check to see if it was working.
After he left the building, I started looking at how he had it plugged in. He still had a cable plugged into the firewall from an internal hub.
He had connected the untrusted side of the firewall to the internal network. I assume that the cable from the Cisco router was plugged into the trusted side of the firewall.
But it really didn't make much difference. I also found the rule set for the firewall. The monitoring company had set it to pass nearly everything in both directions.
The only thing they configured was to block incoming traffic containing our IP addresses. Since it was plugged in backwards, it really just stopped all traffic from going out.
At this point, it would take a lot of convincing to get me to advocate using a monitoring company's services.
By the way, the same so-called "security expert" declared that rules on the Cisco router to block traffic attempting to connect to port 135 and other similar ports constituted a security list and removed them.
Re:I haven't been impressed with monitoring compan (Score:2)
As for your 'security expert', I find it strange that your company management is still listening to him/them after the second fiasco. If you don't have the time to take on security yourself, it might be a good time for you to go out and find someone a bit more capable to handle this stuff.
IF you do have the time to ha
Check your contract (Score:2)
It sounds like they're doing a bunch of stuff that's not strictly necessary for them to do their job. It may convenient for them to scan your servers every second, but if that impacts your business, they need to stop. They're supposed to be there to enhance your business, not impede it.
And if they snagged a copy of your
Re:Check your contract (Score:2)
It's your own fault... (Score:5, Insightful)
You should be able to create a few new services and convince your clients that they don't need to pay a 3rd party to monitor their server, that you can tell them all they need to know, and besides that you don't go down anyway.
It would have been an absoulte fiasco if one of your customers were to attract a Slashdotting...
Re:It's your own fault... (Score:4, Insightful)
WHAT????? What planet are you from that doing ANY kind of network monitoring once a second is considered legit traffic? No, this was either a deliberate attempt to generate a ton of false positives, or total incompetence on the part of the monitoring company.
If I were the owner of the hosting company, the FIRST thing that I would have done was refuse all requests coming in from the monitoring company so I could get traffic flowing for all my customers. That is what they are paying for, after all.
The second thing that I would have done would be to save off copies of all logs that might be considered relavent in a legal situation to read only media.
The third thing that I would have done is send out an email to all affected customers explaining the reasons for the downtime incurred, what had been done to alleviate the situation for all concerned, and that further efforts were ongoing to resolve the issue permanently.
Then, call my lawyers. Ask for a Cease and Desist order to be sent right away.
No way do I play nice with assholes trying to put me out of business.
Monitoring Report: (Score:3, Funny)
Way over the line (Score:2, Interesting)
Your sales people have to figure out how to appease the customers. That's their job. You are a tech and you'll just foul things up using tools like fai
Feel justified (Score:3, Insightful)
Re:Feel justified (Score:2)
Ask for compensaton for their stupidity. (Score:3, Insightful)
Even with a waiver, generally, you can't waive somebody's negligence. Their actions sound negligent in that they used excessive resources such that your servers crashed.
Additionally, it sounds like there may be some form of defamation claim when they complained to your customer base about you. Though defamation claims, especially slander (spoken defamation), are thorny claims that can be hard to prove, it sounds like you may have a number of incidents that may show intentional defamation (much better when seeking damages).
I think, at the very least, your general counsel should be asking for compensation for your downtime.
-A
Configuration, Configuration, Configuration. (Score:2)
It seems that the processes regarding monitoring and maintenance of the monitoring system(s) failed and caused the problems which ensued. If the proper preparation had been done to plan for the level of monitoring which was being done, i.e. 18 GB is didly squat compared to the hundreds of GB at many other enterprise sites, then this likely wouldn't have happened. Like wise, proper levels of logging and tuning a
Easy. A DOS attack. (Score:2)
Now the next step is not technical, but legal. SLAP 'EM WITH A LAWSUIT WORTH MORE THAN THEY'RE EVER MAKE!!!
Re:Easy. A DOS attack. (Score:2)
Re:Easy. A DOS attack. (Score:2)
Of course, I AM NOT A LAWYER.
If you have a legitimate claim, then make a case. (Score:2)
Re:If you have a legitimate claim, then make a cas (Score:2)
How do we get RTFA failures on Ask Slashdot when it's on in the page. This guy didn't ask for this company... his webhosting customers did. He's got to convince his customers that this monitoring company isn't worth their money, because it overmoni
This is not a reputable company (Score:4, Insightful)
In other words, they upsold your customers without your consent. That in itself it unethical and any thought in my mind that this is a 'reputable' company would go away at that point.
You go on to describe how they DoS'd your boxes, and complained to your customers when you took action to protect your customers from the DoS attack.
If their behavior is really as you described, why are you bending over backwords to say how reputable and legitimate they are? They are neither.
Tort, on the case (Score:3, Informative)
It seems as though you've got a tort of negligence on your hands, insofar as they seem unaware, or oblivious to, the damages they are causing you. They do not seem, from your statements, to be wilfully causing damages, but negligence torts need not show (at least in the commonwealth) either wilfulness or intent. You need only show damages, which are an indirect consequence of their actions.
Take into account that torts are, by most accounts, very expensive, though the threat of a tort is often sufficient, or binding arbitration (though that is apparently not oft met with success), or mediation (same deal as binding arbitration). If you do have to litigate, the general rule is somewhere north of $100,000 in damages to justify the transaction cost, from what I have heard. See the first line, though - find a lawyer.
In the least you can establish damages in support of a trespass if you inform them that their actions cause damage, in which case their actions are thereafter wilful, which may make for a cleaner case. The onus in trespass is on the defendent (them) to defend against damages established, not the plaintiff (you); and whereas in negligence, the onus is on the plaintiff (you) to show damages.
Ok, so in gist, take everything I said with a grain of salt, and seek legal counsel. Your jurisdiction may have many options with respect to small claims or public dispute resolution, and I would suggest those because they are significantly cheaper.
Hope that helps.
charge them for it (Score:2)
Charge the security consulting firm with your downtime expenses too... They may refuse to pay, but simply getting the invoice may make them think twice about doing that to you again.
Alert your community of users (Score:2, Insightful)
Alert your users of this fact - send them all an E-mail to alert them of this scam!
You run the show -- not some 3rd party. You set the rules and the security policies. You do the monitoring internally.
I can't believe that monitoring consumed 15GB of space. There's something else going on there. I helped work on a data warehouse t
Fix the contract. (Score:5, Insightful)
1. You have some customers to which you sell services such as email and web space.
2. Some of these customers contracted this monitoring service to watch the servers.
3. The monitoring service caused problems with your servers.
And the answer is:
Correct your hosting contract. Your hosting contract should include provisions for how much usage is reasonable and how the situation will be handled when the customer's usage exceeds those parameters. If the customer insists on doing something stupid which brings the server to its knees, then the customer should pay you enough for you to be able to afford a seperate server for them.
If the sales force insisted that they'd lose sales by bothering the customer with such notions, now would be an excellent time to point out that they just lost sales because they didn't.
As to how much monitoring is too much, the answer is simple: anything the customer is willing to pay for is fine. Anything more is too much.
DoS (Score:2)
Block them off and take them to court.
-uso.
Do the right thing for everyone involved... (Score:2)
Some outside firm wants to do it.
So what's the real problem here?
Costs for bandwidth and storage.
Thus the simple solution:
tell them both you simply
need your costs covered.
Everyone wins, you look like a hero,
and you save yourself from lawyers.
Good luck! -Joel
Re:Do the right thing for everyone involved... (Score:2)
Monitoring Strategy (Score:2, Informative)
The timing need not be more than 15 minutes in most cases. The plan should include the network, web server and applications, and possibly supporting servers such as email or DNS.
The external capabilities are critical - if you are going to do external, use a firm who has profressional managed remote stations in many places.
Tim Goeke
http://www.globalnetwatch.com
Are you kidding me? (Score:5, Insightful)
Why are you putting up with this crap?
As several posters have already mentioned, firewall them off, and then report them to the legal authorities.
Jesus tap-dancing Christ! They are attacking your network. I feel like flaming the original poster for his incompetence. Acquire the BOFH nature. After you firewall them, file a report with the FBI's cybercrime division. Tell them you are a hosting company, and you have the IP of someone who is costing your company $BIGNUM dollars per day because they are DOS-ing your network. That should keep this "monitoring company" busy for a while, and it will teach them a lesson.
Whining about it on slashdot is the last thing you should be doing. Get a clue.
do we all have SUCKER imprinted on our foreheads? (Score:5, Interesting)
ok ok...about the only thing I find remotley factual in this article is the fact that this guy works for a 'company'...however it looks like he works for a company doing exactly the things he is asking about.
First of all, lack of any knowledge of partion or disk utilities to prevent such an occurance is unacceptable. I would not admit that in public about my company even if I used the phrase 'a company I work for', just on the off chance my negligence would be able to be tracked back to me.
Second, why are you not able to offer these services yourself? You make a claim that these people know what they are doing, so if you are at such a level to recognise what they are doing, how come you havent done it already? Did customer service become just a novelty to you? so I doubt this line very much... While I welcome anything that lets our customers use the internet effectively
Doing hosting myself, Im well aware of the tactics you speak of, being that I get bounce mail for nonexistant addresses sent to such titles as; president, ceo, owner, support, tech...and so on. And Im not sure exactly what you mean by 'choked up' your mail server. How do 40k NONEXISTANT addresses manage to slow down your mail server? Is it a 286?
The whole article just smells funny to me, as it seems like you are just pretending to care about the ISP's end and more concerned about the backlash of doing these things. What do you mean how far is to far? Again, if the people in charge cant figure these things out on their own, I would be very hesitant to admit that in a public forum.
Get your technical skills and decision making in line...THEN question how to outsource it..
Re: (Score:2)
You overlooked something. (Score:2)
A couple of comments (Score:4, Interesting)
They are not a reputable company. They are a bunch of retards who should be driven out of the industry with sharp sticks. More to the point, they should be reported to the FBI for conducting a malicioius attack against your network - and you have tangible damage to prove it.
Our first response was to talk to them and explain what we needed them to do, including a list of IPs that we used for customers so they could adjust their monitoring to suit what we thought was reasonable. They chose to ignore the first discussion and continued to abuse the servers. After the email server required a half-day of cleanup, the CTO simply shut them off at the firewalls. Rather than using the contact information they had, they chose to complain to our mutual customers instead. (I should note we do significant monitoring of the servers ourselves, and typically know if something is wrong within minutes of the event.)
Is this typical behavior of monitoring service companies? I know some of them are not reputable at all (due to spamming) however these guys seem to know what they are doing, and yet managed to effectively attack our mail and web servers, as well as doing some things I would not do to the TLD servers. It is hard to feel justified to shutting off someone else's cash-flow, but at the same time we need to defend servers from over zealous monitoring."
Here's a hint for you: Do they offer web hosting services themselves? You may have to dig real deep to find the connection, but if I had to guess, I'll bet they do. And I'll bet they offer it to your customers, based on the fact that they crashed your servers. "Your current service seems to have a lot of downtime. Perhaps you should consider moving to another host. We can make recommendations."
If you find any evidence that they offer any kind of competition to your hosting, report them to the FBI. They may well be a criminal organization engaging in a well orchestrated scam.
Or maybe they're just fucking stoopid. It's hard to tell from here.
The servers are yours (Score:2)
I'm all for customers taking control of what they need to, but you should have a standard set of threshold and event-style criteria that you monitor for, and customers should have access to the logs. Not ALL the logs, mind you, but ones that you think they should be able to see.
This should also be documented in the service contract. You do have a service contract, right? Maybe you know it as a Service Level Agreement...
When Does Website Monitoring Go Too Far? (Score:2)
When monitoring software is that elaborate, it is not unreasonable to expect the software to analyze the logs, produce a simplified brief, and nuke the unneeded information to reduce disk wastage. Software for monitoring is supposed to redu
Heisenberg and monitoring (Score:2, Insightful)
Slashdot the MFers (Score:4, Funny)
This is a case of intentional damage (Score:2)
When it starts costing you money for their 'mistakes', I think it's then time for either them to compensate you, or for you to sue them (in the cas where they don't return compensation).
The worst Ask Slashdot Ever. (Score:2)
According to the 'Book of Slashbot', "A slashdotter must POST first. First must he post, NOT last, but FIRST. Then these STEPS must be undertaken, AFTER the FIRST POSTING: Reload to see if anyone has replied to the POST, then read the article, then reload to see if its slashdotted yet, then reload slashdot to see if a change in karma has taken place, then reply AC to an IDIOT, then RELOA
On a semi-related note ... (Score:2)
You know, the distributed spidering system that IGNORES ROBOTS.TXT and hammers the crap out of anybody that hosts a bunch of websites?
I just recently had to block them with a nifty Apache SetEnvIf, happened to notice quite a few monitoring services hitting us, and then read this article
Oh The Myriad Issues Here... (Score:2)
The second issue is that the third party company is guilty of committing a DOS attack - even if it was oversight and the use of software with legitimate purpouses.
There are two ways to mitigate the situation. The slimy corporate way is to sue the piss out of the former employee and the third party.
not too much... (Score:2)
We used to let the users do the monitoring from external servers, such as ping probes if the server is up, they could look on a web page to see their volume information and so on. Bot we didn't implement e-mail alerting and so on, the only option you had was an occasional SMS. The whole hardeware monitoring (mem usage and so on) was done by the operators inside th
This is the new spam scam (Score:2)
internetseer.com - the newest web scam/spam. Here's something a little bit interesting on the web. This company, internetseer.com, is constantly hitting my site and others ostensibly to get web uptime statistics. Seems pretty harmless, but it does tend to fill up web logs pretty quickly. I don't know why their bot is set to visit this site 20 times a day, so I ended up blocking it. Yesterday, I received an email from one of their sales reps more or less saying, "Hi, we noticed your site was down
Website Monitoring and Your Customers (Score:2, Informative)
Admin on the street says.. (Score:3, Funny)
Admin-on-the-street says "I need a job, you insensitive clod"
Re:To be expected (Score:3, Insightful)
Ha, tell that to all the webmasters with non-compliant HTML out there.
I just thought of a good idea, a web page upload form or something which scans the webpages which gives a nice little dialog about a webpage being non compliant, and may not display correctly in many browsers :) Now to get ANY ISP to implement it... HA!
Re:To be expected (Score:3, Insightful)
"Oh dear God! You've been pinged! The sky is falling!! Whew. It's a damn good thing you installed our over-priced over-hyped personal firewall thingy because we just saved your ass!"
Think I'm kidding? Don't. These ass clowns prey on guilible users that simply don't know any better. It's
Re:This is asking Slashdot to do your job (Score:2, Troll)
Ask Slashdot is about getting advice from tons of people who may have done, experienced, or researched your particular issue themselves.
He's not asking /. to do his job, he's asking for input so *he* can do his job.
If you've gone through life having never asked a question and forged on ahead re-inventing the wheel, please post your name and contact information. I'm sure there are a lot of people who would like to refer you to work for their competitors.
Allow me to t
Re:Damaged rep is your fault (Score:2)
How about itemizing their bandwidth bill (maybe something like Webalizer?) to show that 90% (or whatever) of their traffic comes from one particular IP block, and identify each block with 'whois' record