When Does Website Monitoring Go Too Far?

jafiwam asks: "Recently, the IT department of the company I work for and a 3rd party monitoring and security firm got into a pissing match about how much monitoring is too much. They either got a hold of a customer list from a former employee or walked our IP space to find our web hosting customers. They then proceeded to sell them monitoring services for things such as server up-time, defacement detection, email up-time and DNS testing. While I welcome anything that lets our customers use the internet effectively, their set of monitoring servers filled an entire 18 gig partition full of web server logs (causing the server to crash on a weekend) and choked an email server with 40k some messages that could not be delivered, and they failed to properly brief the hosting customers about what would happen to their log analysis software when faced with 99% traffic from a small set of IPs. These things caused down-time, lost productivity and a damaged reputation. What is appropriate for monitoring a web site and email server? Who should be allowed to monitor? Where should the give and take lie in this situation? I am interested in finding out what admin-on-the-street has to say about this."

"Though I believe they are a reputable company, they are doing some things I do not think are good: checking for the domain names on the TLD servers once per second, downloading various files from the site once per second, and sending email to themselves once per second.

Our first response was to talk to them and explain what we needed them to do, including a list of IPs that we used for customers so they could adjust their monitoring to suit what we thought was reasonable. They chose to ignore the first discussion and continued to abuse the servers. After the email server required a half-day of cleanup, the CTO simply shut them off at the firewalls. Rather than using the contact information they had, they chose to complain to our mutual customers instead. (I should note we do significant monitoring of the servers ourselves, and typically know if something is wrong within minutes of the event.)

Is this typical behavior of monitoring service companies? I know some of them are not reputable at all (due to spamming) however these guys seem to know what they are doing, and yet managed to effectively attack our mail and web servers, as well as doing some things I would not do to the TLD servers. It is hard to feel justified to shutting off someone else's cash-flow, but at the same time we need to defend servers from over zealous monitoring."

Comments

How about enforcing a time-based rule?

[Anonymous Coward]

They must be a way to enforce that they could check, say, only once every hour. And BTW, isn't your company missing an opportunity here? If you're already checking the servers, etc., why not make the tools available to the customers? They'll be more satisfied with the tools, and not having to pay the outside firm. You'll have more satisified customers and less churn....

Re:How about enforcing a time-based rule?

[joeszilagyi]

Except if you open those monitoring tools to your client base, it opens the possibility of them seeing the same info you do, which isn't always a good thing for a variety of technical reasons.

Re:How about enforcing a time-based rule?

[Bios_Hakr]

UUh, maybe I'm missing something here. Why would you not want a customer to see all the data associated with his server.

I work in a network shop that provides connectivity to remote buildings on our campus. Each building has a psuedo-network admin. Usually a second job that some paper-pusher takes to get in good with his boss. By default, the building admin has his home page set to a MRTG log showing every switch in his building. They are trained to look for network spikes on user's ports and notify us so we can disable that port, if nescessary. He can also monitor everything from fan speed to temprature setings on his router and the core router for our remote users.

The obvious answer

[Exiler]

Don't give a company of strangers the key to the front door. There's no reason someone from your company wasn't there to say 'when.' As for when too much is too much, it'd be when the efficiency of your main product is impaired to the point that you lose customers or reputation.

OVERKILL, is what it is.

[joeszilagyi]

Their 'harvesting' your IP block is tacky at the least. That said, the current range of InternetSeer type monitoring is flat out overkill, and doesn't even work right half the time. According to some of them, my site is constantly down, but it *never* is. I know, since I'm an access_log nerd and always play with it; people are always going through it without any large 'dead' blocks appearing. All you need is a remote monitoring system to let you know when your major ports aren't functional, and to have it mail you ONLY when it's down. These 100k emails dripping with HTML to let you know that your site is still up are a complete waste of good bandwidth. Ping your damn site on your major ports, and that's all you need.

Re:OVERKILL, is what it is.

[k12linux]

Ping your damn site on your major ports, and that's all you need.

Sometimes services can lock up to the point where they are not functioning without closing down the port. Something slightly more thurough like nagios should do nicely. ie: Does a simple http request and confirms the reply is ok.

Confidentiality

[Chester K]

They either got a hold of a customer list from a former employee or walked our IP space to find our web hosting customers.

Sounds like you've got an open and shut legal case to recoup those costs they're causing you to incur.

Bad practices all around...

[Jonah Hex]

checking for the domain names on the TLD servers once per second, downloading various files from the site once per second, and sending email to themselves once per second.

They obviously haven't been in the monitoring biz that long, at least not long enough to get a bill for all the bandwidth they're sucking down.

Our first response was to talk to them and explain what we needed them to do, including a list of IPs that we used for customers so they could adjust their monitoring to suit what we thought was reasonable. They chose to ignore the first discussion and continued to abuse the servers. After the email server required a half-day of cleanup, the CTO simply shut them off at the firewalls. Rather than using the contact information they had, they chose to complain to our mutual customers instead. (I should note we do significant monitoring of the servers ourselves, and typically know if something is wrong within minutes of the event.)

Sounds like your company is reasonable, and therefore expecting this possibly "fly-by-night" monitoring company to also be reasonable.

Is this typical behavior of monitoring service companies? I know some of them are not reputable at all (due to spamming) however these guys seem to know what they are doing, and yet managed to effectively attack our mail and web servers, as well as doing some things I would not do to the TLD servers.

I just checked out ClarkConnect's monitoring page (I use their free Linux firewall but not these pay services) and their lowest monitoring interval is 2 minutes for $45/mth, then 5 for $30/mth, 20 for $10/mth and finally 60 mins for $40/yr being the cheapest. Obviously they know such continuous monitoring justifies passing that cost along to the consumer.

It is hard to feel justified to shutting off someone else's cash-flow, but at the same time we need to defend servers from over zealous monitoring."

Thier own biz practices will be the death of them, don't shed any tears over a company that makes this large of a mistake and uses dirty methods to contact customers. I wonder if your now going to have to charge your hosted sites that used the services for the excess bandwidth they used? Maybe cut them a "goodwill" deal on the excess charges?

Jonah Hex

My Take on This

[Bruha]

Okay so you're telling me that a 3rd party company is contacting your web customers and selling them monitoring services that you already provide and some other services that you may or may not provide. They then begin to access your system to do said monitoring but it's crashing your servers.

Lets put it this way.

You provide your customers a service. Part of that user agreement (This is doubly important in a shared server enviroment) that the customer cannot install any software/script/service that impacts the performance of the servers beyond what you say they can. Even the act of using 3rd party monitoring that is causing this problem is in violation of your AUP your customers are contractually binded to. Now I cant see your AUP but I hope there are provisions in there stating this.

Now as far as the 3rd party company goes. You need to have your legal department file a cease letter to them with a explanation of the problems they're causing and until things can be worked out they are not permitted to conduct business across your network.

You also need to notify your customers the actions you're taking on this company and why. Also pointing out your AUP/SLA's with them and the un acceptable behavior of the company that was selling them services. Tell them what you can monitor and explain what they really need.

In the assumption of a web/email then all you need to do is monitor the ports and maybe a script that will verify the email server is accepting connections on a minute basis. That's all you need for that setup. Also if they're allowed to telnet into the box (SSH I hope) then you'd also monitor the SSH port as well to ensure they can connect to their equipment.

If you're co-locating: Then I would suggest getting a Nagios setup running and sell some sort of monitoring to your customers. A good example would be the system that springboardhosting.com provides to their users. We use them as our colo partner and I've had no complaints. Though we only use the basic monitoring I do have advanced tools at the house and my laptop should I feel I need to watch any critical services. And I use webmin to monitor peer servers and page my phone in case there are any problems.

You're in a pickle at the moment but I think your customers will appreciate cutting off the source of the outages. Nobody needs to know if their service is up by the second unless it's some sort of huge database application and then you'd have special provisions to monitor it and not remotely.

That company is basically DDOS'g your servers to death. So it's basically them or you. I think the choice is simple :)

Hope that helps.

It's your own fault...

[LostCluster]

Your system should have been set up to attribute the log file to the disk space of each client, causing them to eventually hit their limit and lose their abilty to log any further. No set of requests from the outside world should be able to bring down your server short of a vicious DOS attack, which clearly this wasn't. This was a an overload level of legit traffic, if your server can't handle it then you need a better server.

You should be able to create a few new services and convince your clients that they don't need to pay a 3rd party to monitor their server, that you can tell them all they need to know, and besides that you don't go down anyway. :)

It would have been an absoulte fiasco if one of your customers were to attract a Slashdotting...

Re:It's your own fault...

[sgtrock]

This was a an overload level of legit traffic, if your server can't handle it then you need a better server.

WHAT????? What planet are you from that doing ANY kind of network monitoring once a second is considered legit traffic? No, this was either a deliberate attempt to generate a ton of false positives, or total incompetence on the part of the monitoring company.

If I were the owner of the hosting company, the FIRST thing that I would have done was refuse all requests coming in from the monitoring company so I could get traffic flowing for all my customers. That is what they are paying for, after all.

The second thing that I would have done would be to save off copies of all logs that might be considered relavent in a legal situation to read only media.

The third thing that I would have done is send out an email to all affected customers explaining the reasons for the downtime incurred, what had been done to alleviate the situation for all concerned, and that further efforts were ongoing to resolve the issue permanently.

Then, call my lawyers. Ask for a Cease and Desist order to be sent right away.

No way do I play nice with assholes trying to put me out of business.

Fix the contract.

[Spazmania]

If I understand you right:
1. You have some customers to which you sell services such as email and web space.
2. Some of these customers contracted this monitoring service to watch the servers.
3. The monitoring service caused problems with your servers.

And the answer is:

Correct your hosting contract. Your hosting contract should include provisions for how much usage is reasonable and how the situation will be handled when the customer's usage exceeds those parameters. If the customer insists on doing something stupid which brings the server to its knees, then the customer should pay you enough for you to be able to afford a seperate server for them.

If the sales force insisted that they'd lose sales by bothering the customer with such notions, now would be an excellent time to point out that they just lost sales because they didn't.

As to how much monitoring is too much, the answer is simple: anything the customer is willing to pay for is fine. Anything more is too much.

Are you kidding me?

[dan14807]

Why are you putting up with this crap?

As several posters have already mentioned, firewall them off, and then report them to the legal authorities.

Jesus tap-dancing Christ! They are attacking your network. I feel like flaming the original poster for his incompetence. Acquire the BOFH nature. After you firewall them, file a report with the FBI's cybercrime division. Tell them you are a hosting company, and you have the IP of someone who is costing your company $BIGNUM dollars per day because they are DOS-ing your network. That should keep this "monitoring company" busy for a while, and it will teach them a lesson.

Whining about it on slashdot is the last thing you should be doing. Get a clue.

Something smells fishy here

[darkonc]

I mean jeez that must have been thousands and thousands of hits to use up that much space.

$ units bits/second bits/day
* 86400

So you're looking at (roughly) 100K hits per day per file downloaded per site. If they're downloading 15 files per site, and you've got 100 sites on the box, then you're looking at an increase of about 120 million requests per day. My acess log has an average of 200bytes/er line, so you're now looking at 120Mrequests*200bytes/request == a sudden jump of 24gigabytes of logging per day.

Then you've got the effective mail-bombing to deal with.

The article author said that these people sounded like they know what they're doing, so that leaves (in my mind), two likely possibilities:

1. They're really really good snow-job artists. They understand the terminology, but they have no real sense of methodology or purpose.
2. They really do know what they're doing, and they're trashing your servers with intent.

I mean -- for crying out loud: Multiple files once per second? And just how long did it take them to inform your customers that they'd managed to crash the servers? Monitoring granularity of more than about one quarter the normal notification time is a complete waste of resources -- and that's giving them lots of leeway to waste.

And Tens of thousands of undelivered emails??? If those emails didn't get delivered, then what did the company do when they didn't arrive in short order? Why didn't they stop the transmission and diagnose why the emails weren't coming thru? If the emails really are undeliverable, then how in the world did you manage to conclude that they know what they're doing?

Other notes (mostly mentioned elsewhere)

• are you charging your customers based on their net volume? If so, have you informed your customers of what sort of costs these, uhm, people are imposing on them in addition to their monitoring fees?

• I'm guessing that your AUP includes a clause on activities that wilfully or negligently cause inappropriate server load, outages, etc. I think that this company's "services" classifies.
• I think that you had better seriously consider possibility #2 above. Meticulously document what they've done to your servers (including somehow scamming your customer list). Have that information ready to present to your customers and/or a judge. If all goes well, you won't need it, but I'm not expecting all to go well, given how they've gone so far.

One last point -- Even though you may be dealing with a company that you think has a (otherwise) good reputation, doesn't mean that you're not dealing with an inept department of an otherwise good company. Sometimes the VP Engineering puts his/her stupid cousin in some group where they're not likely to do much damage, and then finds out that the goofball has managed to get out 'in the wild' with a 'bright' idea.