Hello,
I found that my modified nfacctd (that reads Netflow streams at its
stdin) leaves a background process when it terminates (on input eof).
When used with a pipe, the problem is worse, since the pipe as a whole
doesn't terminate, for example when using:
% flow-export6 -f6 < /tmp/ft-v07.2005-10-12.073001+0200 | ./nfacctd -f
~amir/nfacctd-ex2.conf | bzip2 -1 > /tmp/2.out &
After much time:
[1] + Done flow-export6 -f6 <
/tmp/ft-v07.2005-10-12.073001+0200 |
Exit 1 ./nfacctd -f ~amir/nfacctd-ex2.conf |
Running bzip2 -1 > /tmp/2.out
(flow-export6 is my modified flow-export.)
What happens is that the print plugin doesn't terminate:
% strace -p 985
poll([{fd=3, events=POLLIN}], 1, 1000) = 0
time(NULL) = 1129242375
poll([{fd=3, events=POLLIN}], 1, 1000) = 0
time(NULL) = 1129242376
poll([{fd=3, events=POLLIN}], 1, 1000) = 0
time(NULL) = 1129242377
poll( <unfinished ...>
[CTRL-C...]
%
The relevant code from print_plugin.c:
--
/* plugin main loop */
for(;;) {
poll_again:
ret = poll(&pfd, 1, timeout);
if (ret < 0) goto poll_again;
now = time(NULL);
switch (ret) {
case 0: /* timeout */
if (qq_ptr) {
switch (fork()) {
case 0: /* Child */
P_cache_purge(queries_queue, qq_ptr);
exit(0);
default: /* Parent */
P_cache_flush(queries_queue, qq_ptr);
refresh_deadline += config.print_refresh_time;
qq_ptr = FALSE;
break;
}
}
break;
..
}
}
--
poll() returns 0 and qq_ptr is 0 so the loop continues.
I noted that the problem doesn't exist with pmacctd when
it reads a pcap_savefile. How can this problem be fixed
in nfacctd? Currently I just exit from the main nfacctd
on eof:
--
ret = fread(&reclen, 1, sizeof(reclen), stdin);
if (ret == 0) {
if (ferror(stdin))
Log(LOG_INFO, "INFO ( default/core ): error on stdin: errno %d\n",
errno);
else
Log(LOG_INFO, "INFO ( default/core ): End of file on stdin\n");
exit(1);
--
Thanks,
Amir
