On Tue, 31 Mar 2015, John P. Rouillard wrote: > Hi David: > > In message <alpine.deb.2.02.1503311452250.26...@nftneq.ynat.uz>, > David Lang writes: >> before I realized that I really only needed USR2, I was sending sec >> a HUP to get it to close all it's output files (for log rotation), >> but I was running into the problem that the HUP restart looses all context. > > Not just context but all correlation operations and variables (however > variables set explicitly via perl functions/expressions IIRC aren't > flushed). > >> There is the SEC_RESTART event that shows up after the HUP finishes and >> all state is cleared, but it doesn't look like SEC_SHUTDOWN takes place >> prior to the HUP. > > Yeah I can see the agrument for that, but I would really expect a > SEC_SHUTDOWN only when it's really being shut down. > >> Am I missing something? or is there no way to save state when a HUP >> is received? > > I don't think you are missing anything. I am not sure if it makes sense to > create events for: > > PRE_SEC_RESTART - this event will be the last event that SEC sees before > reloading its configuration (HUP) > > PRE_SEC_SOFTRESTART - this event will be the last event that SEC sees > before reloading its configuration (ABRT) > > PRE_SEC_LOGROTATE - this event will be the last event that SEC sees > before reopening its log file and closing its outputs (USR2) > > just for completeness. > > I can't think of an occasion where I would send a HUP to a SEC and > want to retain the state. (Then again I don't find keeping state and > reloading it after a shutdown/restart (SIGTERM/ service restart) to be > very useful given all the caveats associated with it.) > > I am interested in what your use case would be for these theoretical > events.
This started with me running sec from rsyslog and hitting the file rotation problem because when rsyslog is sent a HUP to have it close it's outputs, sec doesn't receive anything. So I slapped a quick HUP for sec in my rotate script and reported this on the rsyslog mailing list. A day later, there's a feature in rsyslog git so that when a HUP is sent to rsyslog, it will send a HUP on to programs that it's started. Thinks seemed to be working, until I setup another ruleset in sec to alert for logs disappearing on my (if the last log is >3 min ago, send one e-mail), but this wasn't firing reliably because the logs were rotating every 5 min and the HUP erased the sec history. so I changed my rotate script to send USR2 and reported this to the rsyslog list to see about making it so that when rsyslog receives a HUP it can send a different signal to it's child processes. That's pending, but in the meantime, as I'm working on various sec rulesets, I may have a bunch of different copies of sec running, each receiving a different feed (different subsets of traffic, and different contents in what is being sent). It's FAR easier to do killall -HUP sec than to figure out which of the several copies of sec I need to send the signal to. So, eventually, I will be able to work around the issues that triggered my desire for a pre_restart event. But as the system gets more complex and grows more instances of sec running, working around the lack is going to keep getting more complex. David Lang ------------------------------------------------------------------------------ Dive into the World of Parallel Programming The Go Parallel Website, sponsored by Intel and developed in partnership with Slashdot Media, is your hub for all things parallel software development, from weekly thought leadership blogs to news, videos, case studies, tutorials and more. Take a look and join the conversation now. http://goparallel.sourceforge.net/ _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
