Slashdot Mirror

← Back to Stories (view on slashdot.org)

When Does Website Monitoring Go Too Far?

Posted by Cliff on from the your-right-to-monitor-ends-at-my-reset-switch dept.

jafiwam asks: "Recently, the IT department of the company I work for and a 3rd party monitoring and security firm got into a pissing match about how much monitoring is too much. They either got a hold of a customer list from a former employee or walked our IP space to find our web hosting customers. They then proceeded to sell them monitoring services for things such as server up-time, defacement detection, email up-time and DNS testing. While I welcome anything that lets our customers use the internet effectively, their set of monitoring servers filled an entire 18 gig partition full of web server logs (causing the server to crash on a weekend) and choked an email server with 40k some messages that could not be delivered, and they failed to properly brief the hosting customers about what would happen to their log analysis software when faced with 99% traffic from a small set of IPs. These things caused down-time, lost productivity and a damaged reputation. What is appropriate for monitoring a web site and email server? Who should be allowed to monitor? Where should the give and take lie in this situation? I am interested in finding out what admin-on-the-street has to say about this."

"Though I believe they are a reputable company, they are doing some things I do not think are good: checking for the domain names on the TLD servers once per second, downloading various files from the site once per second, and sending email to themselves once per second.

Our first response was to talk to them and explain what we needed them to do, including a list of IPs that we used for customers so they could adjust their monitoring to suit what we thought was reasonable. They chose to ignore the first discussion and continued to abuse the servers. After the email server required a half-day of cleanup, the CTO simply shut them off at the firewalls. Rather than using the contact information they had, they chose to complain to our mutual customers instead. (I should note we do significant monitoring of the servers ourselves, and typically know if something is wrong within minutes of the event.)

Is this typical behavior of monitoring service companies? I know some of them are not reputable at all (due to spamming) however these guys seem to know what they are doing, and yet managed to effectively attack our mail and web servers, as well as doing some things I would not do to the TLD servers. It is hard to feel justified to shutting off someone else's cash-flow, but at the same time we need to defend servers from over zealous monitoring."

5 of 259 comments (clear)

  1. SHUT UP AND DO YOUR JOB BITCH by Anonymous Coward · · Score: -1, Flamebait

    STOP COMPLAINING

  2. Re:How about enforcing a time-based rule? by joeszilagyi · · Score: -1, Flamebait

    My bad. Long live full disclosure of all things, no matter how bad it would be for them to be disclosed!

    --
    Dude, where's my packet?
  3. I see, the Al Gore 2004 campaign in action by Anonymous Coward · · Score: -1, Flamebait

    good to seem them monitoring George Bush 2004 web sites.

  4. Re:It's your own fault... by PinkFreud · · Score: 0, Flamebait

    Nothing worse than a vicious Disk Operating System attack. MS-DOS was particularly nasty. Or, perhaps you meant DoS (as in Denial of Service)...

  5. To God I Pray by Anonymous Coward · · Score: -1, Flamebait

    The nigger is my shepherd
    The mexican is my cook
    Moi eath the burrito whole
    Now burneth my asshole.

    Thy God I pray
    to endow me with a pole
    a pole so big
    no chick can swallow it whole

    So God, give me food
    give moi sex which feels so good
    give me a rock-hard log
    and lots of sex with a dog.

    amen.