2012/7/20 Mike Ellis <[email protected]>: > Hi All, I'm new to SEC... I like it so far. > > Still doing mostly simple things, but I'm starting to gradually get more > complex. > > I ran into something that didn't act exactly as I expected and wanted to see > how others are dealing with this. > > -- > > Sending the SEC process a SIGTERM signal is supposed to trigger a "graceful > shutdown". > The shut-down seems to work, but for the GRACEFUL part, I expected contexts > that are buffered (but not time-completed) to be "timed-out/flushed". (like > an apache gracefull shut-down, it finishes active connections etc). A HARD > (non-graceful shutdown) should KILL the context buffers (without flushing), > but shouldn't a graceful shutdown simply expire the timers so they > finish/flush & the proper actions take place?
hi Mike, that entirely depends on the task you are having. In some cases, it could be nice to execute the action-on-expire lists of contexts, while in other cases it is clearly not feasible. For example, consider a context REPEATED_FRAUDULENT_TRANSACTIONS_DURING_24H with action-on-expire "close a credit card". If the action for this context is prematurely executed (say, just after 5 minutes), there will be issues. That's why the context expiration is not the default, but you rather have several options to configure this manually: 1) run SEC with --intevents command line option and configure specific context expiring actions for SEC_SHUTDOWN event, 2) if you actually want to preserve contexts across shutdowns and restarts, you can easily save contexts data structures to disk at shutdown, and restore them at startup. The following FAQ entry should shed some light into the technical details: http://simple-evcorr.sourceforge.net/FAQ.html#15 with kind regards, risto > > thanks, > > -- MikeE > > > > ------------------------------------------------------------------------------ > Live Security Virtual Conference > Exclusive live event will cover all the ways today's security and > threat landscape has changed and how IT managers can respond. Discussions > will include endpoint security, mobile security and the latest in malware > threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ > _______________________________________________ > Simple-evcorr-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
