[Bro-Dev] #970: broctl stop/restart eating logs?

Bro Tracker bro at tracker.bro.org
Mon May 13 17:03:25 PDT 2013

#970: broctl stop/restart eating logs?
  Reporter:  robin           |      Owner:  dnthayer
      Type:  Problem         |     Status:  assigned
  Priority:  High            |  Milestone:  Bro2.2
 Component:  BroControl      |    Version:  git/master
Resolution:  Solved/Applied  |   Keywords:
Changes (by robin):

 * owner:   => dnthayer
 * status:  new => assigned
 * type:  Merge Request => Problem


 The fix for preventing the premature delete looks a bit brittle to me.
 What if the archving needs longer than the time the script is waiting?
 With huge log files that can happen. Also, relying on all '*.*-*.log'
 go away makes me feal uneasy.

 Here's an alternative idea:

     - change archive-log to create a file ".archive-log.running.<pid>.tmp"
       at startup, where pid is the PID of the archive-log instance. At
       termination, remove that file.

     - in post-terminate, wait until all ".archive-log.running.*.tmp"
       are gone, but keep checking if the PIDs are still active
       (easiest if the PID writing into the tmp file as well). If not,
       remove the file manually.

 Do you think that would work?

Ticket URL: <http://tracker.bro.org/bro/ticket/970#comment:9>
Bro Tracker <http://tracker.bro.org/bro>
Bro Issue Tracker

More information about the bro-dev mailing list