[Zeek-Dev] Zeek Supervisor Command-Line Client

Jon Siwek jsiwek at corelight.com
Thu Jun 18 13:15:14 PDT 2020


On Thu, Jun 18, 2020 at 7:45 AM Vlad Grigorescu <vlad at es.net> wrote:

> My main concern was Broker version incompatibilities between the newly-installed zcl, and the running cluster, which I think would be addressed by that (i.e. to stop a cluster, you stop the supervisor service on the manager, and then the other services will lose their connection and also stop).

A clarification that may help you: the "orphaning" behavior isn't
related to Broker connections, it's related to the parent-child
relationship between processes.  So there's a process tree here with
`zeek` in supervisor-mode at the root and child processes that are
individual cluster nodes (worker, manager, logger, proxy).

The normal termination behavior for the supervisor process is to
gracefully kill and wait for all children to exit.  In the very
exceptional case of the supervisor exiting/crashing without having
cleaned up all children, those children will self-terminate upon
noticing they are no longer parented to the supervisor.

- Jon



More information about the Zeek-Dev mailing list