Hi Risto, I think I found a bug (or a mistake in the documentation) in SEC.
The manpage says: > SEC_SHUTDOWN - generated when SEC receives the SIGTERM signal, or when > SEC reaches all EOFs of input files after being started with the --notail > option. With the --childterm option, SEC sleeps for 3 seconds after > generating SEC_SHUTDOWN event, and then sends SIGTERM to its child processes > (if a child process was triggered by SEC_SHUTDOWN, this delay leaves the > process enough time for setting a signal handler for SIGTERM). However, when I restart sec (i.e. stop and immediatels start the process), I get: > Mon Jul 17 12:36:36 2017: SIGTERM received: shutting down SEC > Mon Jul 17 12:36:36 2017: Creating SEC internal context 'SEC_INTERNAL_EVENT' > Mon Jul 17 12:36:36 2017: Creating SEC internal event 'SEC_SHUTDOWN' > [...] > Mon Jul 17 12:36:36 2017: SEC (Simple Event Correlator) 2.7.11 > Mon Jul 17 12:36:36 2017: Changing working directory to / No sign of any 3 second delay ... I found this because I use two rules triggering on SEC_SHUTDOWN. Neither of them runs more than 3 seconds (far less, in fact), but depending on the order I have them processed, only one of them gets executed. The one that runs slightly longer, if run first, keeps the second from executing altogether. No log entry, no error, nothing - it isn't started at all. When I replace both actions with a logonly, both run fine irrespectively of the order, so it's quite clearly a matter of timing. However, with the 3 second delay it should work in any case, 3 seconds should be ample of time for both to complete. I must add that both are calling perl functions, no shellcmd whatsoever. One is called via lcall, the other via call. Best regards, Peter. ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
