On 05/23/2011 05:10 PM, Jeff Schroeder wrote: > 2011/5/23 Matthieu Pérotin<matthieu.pero...@bull.net>: >> Le vendredi 20 mai 2011 à 18:11 +0300, Risto Vaarandi a écrit : >>> On 05/20/2011 02:56 PM, Matthieu Pérotin wrote: >>>> Hi, >>>> >>>> we recently experienced an annoying problem with processes that, in some >>>> circonstances, would get stuck and never return. The fault here is >>>> clearly on the processes side, but one can never be sure that a process >>>> will return nicely... The consequence on SEC's side is that child >>>> processes remain attached to the SEC process, cluttering its %children >>>> hash table and adding to the complexity of the check_children sub. >>>> >>>> A solution to the problem would be to have the possibility to give a >>>> timeout option to the shellcmd action: on expiration a sigterm (or >>>> sigkill, I'm still not sure) would be issued to the process that was >>>> launched. > > Another way of implementing this would be to use native perl and > perl's builtin alarm[1] function. Admittedly, it would be much nicer > to have this rolled in to a new action such as: > action=shellcmdto 30 /bin/yourprog > > But thats up to Risto to decide. >
What about having a command line option that would set a common run time limit for all child processes, started from all action types and SingleWithScript rule? If specific treatment of individual processes is desired, one can either employ the approach from FAQ (http://simple-evcorr.sourceforge.net/FAQ.html#25), or set run time limit with the command line option and trap SIGTERM for processes that should run forever. regards, risto ------------------------------------------------------------------------------ All of the data generated in your IT infrastructure is seriously valuable. Why? It contains a definitive record of application performance, security threats, fraudulent activity, and more. Splunk takes this data and makes sense of it. IT sense. And common sense. http://p.sf.net/sfu/splunk-d2d-c2 _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
