[Zeek-Dev] Zeek Supervisor Command-Line Client

Seth Hall seth at corelight.com
Tue Jun 30 06:35:12 PDT 2020

Sorry for chiming in late on this...

On 19 Jun 2020, at 14:46, Jon Siwek wrote:

> Ack, got it and agree that the distinction is likely helpful: the
> supervisor node implements the low-level "dirty work" of stopping
> processes and can ensure shutdown of its entire process tree if it
> really has to, but the client can carry out shutdown logic with a
> higher-level of insight into directing a shutdown process (possibly
> across many hosts) in orderly fashion.

I think that the script we ship with zeek that effectively implements 
the supervisor behavior should understand the business logic of shutting 
down a cluster in the correct order.  One way to think about it is that 
the supervisor script will presumably understand the business logic for 
starting a cluster in the right order so consequently it would seem that 
it should understand how to shut down the cluster as well.

We talked about it recently and now that I've had some more time to 
think about it I'm really starting to think that the business logic for 
correctly starting and stopping a cluster should be fully implemented in 
the supervisor script.  The zeekc tool could then just be a dumb tool 
that says to start and stop and doesn't end up causing us to spread our 
logic around to other tooling.


Seth Hall * Corelight, Inc * www.corelight.com

More information about the Zeek-Dev mailing list