What is resource exhaustion?¶
The practical answer¶
Resource exhaustion occurs when a system cannot continue normal operation because a finite resource has been consumed.
The key evidential caution¶
The dangerous assumption is that resource exhaustion always means a high-volume attack.
It may result from:
Key points¶
- memory depletion
- processor saturation
- connection limits
- thread exhaustion
- disk space loss
- queue overload
- database locks
- file-handle limits
- provider quotas
- runaway legitimate processes
An offender may deliberately trigger resource exhaustion through repeated or specially crafted activity.
What investigators should establish¶
Investigators should establish:
Key points¶
- which resource was exhausted
- what consumed it
- when the condition began
- whether demand was legitimate, accidental or malicious
- what recovery action restored service
- whether the same pattern recurred
Relevant evidence¶
Relevant evidence may include system performance data, application logs, process activity, provider telemetry, error messages and traffic records.
Evidential limits¶
Do not infer attack solely from the fact that a limit was reached.
A software defect or poor capacity planning may produce the same technical outcome.
Likewise, malicious requests may exploit an existing weakness rather than create extraordinary volume.
Resource exhaustion may also continue after malicious traffic stops because queues, locked processes or failed dependencies take time to recover. Record the recovery sequence and any manual intervention. This prevents the entire outage duration being attributed automatically to continuing attacker activity.
Resource limits may also be imposed by a cloud provider, licence or service plan rather than by the local hardware. Preserve quota, throttling and billing records where relevant. A service can fail because a provider limit was deliberately triggered or simply because demand exceeded the purchased capacity.
Operational takeaway¶
Identify the exhausted resource and the activity consuming it, and separate deliberate abuse from failure, defect and legitimate overload.