[Bro-Dev] #970: broctl stop/restart eating logs?

[Bro Tracker]

#970: broctl stop/restart eating logs?
-----------------------------+------------------------
  Reporter:  robin           |      Owner:  dnthayer
      Type:  Problem         |     Status:  assigned
  Priority:  High            |  Milestone:  Bro2.2
 Component:  BroControl      |    Version:  git/master
Resolution:  Solved/Applied  |   Keywords:
-----------------------------+------------------------

Comment (by dnthayer):

 Replying to [comment:9 robin]:
 >
 > The fix for preventing the premature delete looks a bit brittle to me.
 > What if the archving needs longer than the time the script is waiting?
 > With huge log files that can happen. Also, relying on all '*.*-*.log'
 > go away makes me feal uneasy.

 If a log file takes more than 10 minutes (this number was
 chosen arbitrarily) to archive, then the tmp directory
 simply doesn't get deleted.  In that case the problem is
 we don't know if archive-log is just slow or if it
 terminated prematurely (in which case the log file would
 never be archived, no matter how long we wait).

 > Here's an alternative idea:
 >
 >     - change archive-log to create a file ".archive-
 log.running.<pid>.tmp"
 >       at startup, where pid is the PID of the archive-log instance. At
 >       termination, remove that file.
 >
 >     - in post-terminate, wait until all ".archive-log.running.*.tmp"
 >       are gone, but keep checking if the PIDs are still active
 >       (easiest if the PID writing into the tmp file as well). If not,
 >       remove the file manually.
 >
 > Do you think that would work?

 If archive-log manages its own PID file, then we can
 get rid of the arbitrary 10 minute maximum waiting time,
 and just wait however long it takes for archive-log to
 finish.

 I will push this change soon.

-- 
Ticket URL: <http://tracker.bro.org/bro/ticket/970#comment:10>
Bro Tracker <http://tracker.bro.org/bro>
Bro Issue Tracker