In message <1362072465.78334.yahoomail...@web125401.mail.ne1.yahoo.com>,
chris heidbrink writes:
>Forgive me - not following exactly what you are advising I try.
> I enabled tracing in the expect script - with --detach mode I
>don't see any of the debug information. Without --detach I do
>see everything and it finishes/completes as expected. If I run
>with:
>
>sudo /usr/bin/perl -w /usr/bin/sec.pl --conf=/etc/sec.conf --quoting
> --input=/var/log/local3 --pid=/var/run/sec.pid --syslog=daemon
> > /dev/null 2>&1
>
>It completes as expected.
I'll bet it's stdin that's failing somehow since you didn't
redirect it in your command.
>If I put a & on the end of that and run in the background it gets
>hung up again on in the expect script.
That sounds like it may be trying to read from stdin and is just
waiting for somebody to respond.
However,
>I changed my sec.conf file to this:
>
># Executing on arbor alert
>
>type=Single
>continue=TakeNext
>ptype=RegExp
>pattern=\s\d\d:\d\d:\d\d\s(.*)\spfsp:\sanomaly\sTotal_traffic_rate_Misuse\s+
>id\s+(\d+)\s+status\s+ongoing\s+severity\s+3\s+classification\s+medium\s+imp
>act\s+\".*\"\s+src\s+0\.0\.0\.0\/0\s+All\s+dst\s+(\d.\d.\d.*\/32)
>desc=Arbor hostname $1 alertid $2 blackholeip $3
>action=spawn exec /usr/bin/addarborpfBlackholeexp.pl $1 $2 $3 $0 > /dev/null
> 2>&1
>
>
>And it works fine.
which is odd I can't think of any reason redirecting it in the
command vs redirecting it in the parent SEC process should behave
differently. Also you didn't redirect stdin so my guess about it
being a stdin issue looks like it's wrong.
>I have to believe it's something with stdin/out/error with expect.
Yup that's how I am leaning.
It's possible your perl process is doing something with
stdin/out/err before calling expect and the location of
redirection/backgrounding somehow changes what the perl code is
doing.
>I'll look through the trace and expect options to see if there
>is anything there I can adjust. Let me know if you have any
>other suggestions and thank you for your patience/help.
You're welcome. This is really an odd problem.
--
-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.
------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_feb
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
