[Bro-Dev] [JIRA] (BIT-1396) Logs disappearing on broctl restart

[Aashish Sharma (JIRA)]

    [ https://bro-tracker.atlassian.net/browse/BIT-1396?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=20704#comment-20704 ] 

Aashish Sharma commented on BIT-1396:
-------------------------------------

Ah! Yes, I see logs in spool/tmp/post-terminate-YYYY-MM-DD-HH-MM-SS-PID. 

Is there a way to know if archival failed and what caused the failure. Unless one goes to explicitly account for  entire days of logs, it seems like this is a silent failure. One might end up unknowingly missing chunks of logs. 

If I recall my workflow was, edit script, introduce a bug, broctl start fails, fix the bug, retry. Still not sure what action got archival failure. 

Aashish 


-- 
Aashish Sharma	(asharma at lbl.gov) 				 
Cyber Security, 
Lawrence Berkeley National Laboratory  
http://go.lbl.gov/pgp-aashish 
Office: (510)-495-2680  Cell: (510)-612-7971


> Logs disappearing on broctl restart
> -----------------------------------
>
>                 Key: BIT-1396
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-1396
>             Project: Bro Issue Tracker
>          Issue Type: Problem
>          Components: Bro
>    Affects Versions: 2.4
>            Reporter: Aashish Sharma
>            Priority: High
>             Fix For: 2.4
>
>
> Noticed that on certain restarts of bro-2.4-beta, logs arbitrarily disappear.
> Restarts happen as
> - broctl check; broctl restart
> - broctl check; broctl restart --clean
> - broctl restart
> or some variant - not precisely sure. But all log files for that duration of restarts are missing



--
This message was sent by Atlassian JIRA
(v6.5-OD-03-002#65000)