If you need to re-read the configs and PRESERVE contexts, the documentation sez:
# if SIGHUP has arrived, reopen input files and logfile, re-read # configuration and empty all lists concerning events and correlation # information; if SIGABRT has arrived, behave like SIGHUP but preserve # contexts that are active That sounds like a good idea. However, I'm not sure if I want my timed events firing on a graceful shut if they really did not. It could send a false positive that something occured when it had not (yet). Therefore, I think you'll have to write that yourself. :) -- Justin J. Novack ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
