We recently experienced a LISTSERV service outage as a result of a list configuration error by a list owner. The list owner changed the list configuration to specify the list address as the primary editor. This was a moderated list and she was attempting to reconfigure the list to allow subscribers to post without approval, however, she apparently misunderstood the instructions she was given by one of our staff. When the next message was posted to the list, LISTSERV sent an approval request to the primary editor - the list address. When that message was delivered, LISTSERV sent another approval request, and another, and another, each larger than the last. LISTSERV keeps a copy of each pending request in its file system, and it took about an hour to fill the file system to capacity with over 500 MB of self-referential approval requests. At that point, this loop was broken, however, with its file system at 100% of capacity, LISTSERV was unable to accept any other incoming messages, all of which were bounced to the LISTSERV postmaster mailbox. The incident occurred at approximately 7:00 p.m. By the time I discovered the problem the next morning, over 1000 messages had been bounced to the LISTSERV postmaster mailbox. These included routine daily update jobs for several hundred local lists, jobs from other LISTSERV servers, and messages to other lists hosted on our server. This is, first and foremost, a list owner education issue, but I have asked L-Soft to consider adding logic to the validity checking that is done during PUT processing, to reject a PUT in which the address of a local list is specified as an owner, editor, or moderator. The PUT processing logic verifies the existence of lists specified on the "sub-list=" statement. It seems to me that similar logic could be used to trap local list addresses on owner, editor and moderator statements. -- Paul Russell Senior Systems Administrator University of Notre Dame http://www.nd.edu/~prussell