New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Dev log rollover v4 - Signal Based Logfile Rotation #977
Conversation
in file rotation on SIGHUP.
for log rotation. Have the LogFileCtx handle the log rotation.
Useful for using passing the buffer through to another writer such as LogFileCtx.
- alert debug log - fast log - stats log - dns log - drop log - file log - http log - tls log - eve/json log
I'm wondering how this will work with the unix-socket runmode. There the logger threads are created and destroyed per pcap. How will this affect the 'reload' flag? As I'm not seeing a unregister call, I fear we may end up with dangling pointers there. |
Good point. I wonder if this type of rotation should be disabled in this mode? |
I would prefer to just handle it, so that we don't have too many exceptions. If we can 'un-register' at thread shutdown, it should automatically handle this case. |
Have -T / --init-errors-fatal process all rules so that it's easier to debug problems in ruleset. Otherwise it can be a lengthy fix, test error cycle if multiple rules have issues. Convert empty rulefile error into a warning. Bug #977
Have -T / --init-errors-fatal process all rules so that it's easier to debug problems in ruleset. Otherwise it can be a lengthy fix, test error cycle if multiple rules have issues. Convert empty rulefile error into a warning. Bug #977
Have -T / --init-errors-fatal process all rules so that it's easier to debug problems in ruleset. Otherwise it can be a lengthy fix, test error cycle if multiple rules have issues. Convert empty rulefile error into a warning. Bug #977
Have -T / --init-errors-fatal process all rules so that it's easier to debug problems in ruleset. Otherwise it can be a lengthy fix, test error cycle if multiple rules have issues. Convert empty rulefile error into a warning. Bug #977
Have -T / --init-errors-fatal process all rules so that it's easier to debug problems in ruleset. Otherwise it can be a lengthy fix, test error cycle if multiple rules have issues. Convert empty rulefile error into a warning. Bug #977
Have -T / --init-errors-fatal process all rules so that it's easier to debug problems in ruleset. Otherwise it can be a lengthy fix, test error cycle if multiple rules have issues. Convert empty rulefile error into a warning. Bug OISF#977
Deprecates PR #871.
This PR is just a rebase.
Buildbot: