Re: [Sguil-devel] Sguil-server port for FreeBSD

[Bamm V. <bam...@gm...>]

You shouldn't have to send a kill to all three procs, only the main
one. I don't have an answer as to why the main sguild proc is being so
stubborn right now.

Bammkkkk


On 3/30/06, Paul Schmehl <pa...@ut...> wrote:
> Here's what I'm seeing:
>
> I identify the pids involved:
> bash-2.05b# ps -auxw | grep sguild
> root    17315  0.0  0.7  3636 2868  p0- I     5:13AM   0:00.11
> /usr/local/bin/tclsh8.4 /usr/local/bin/sguild -D -c /usr/local/etc/s
> root    17319  0.0  0.7  3564 2788  p0- I     5:13AM   0:00.01
> /usr/local/bin/tclsh8.4 /usr/local/bin/sguild -D -c /usr/local/etc/s
> root    17321  0.0  0.7  3564 2792  p0- I     5:13AM   0:00.01
> /usr/local/bin/tclsh8.4 /usr/local/bin/sguild -D -c /usr/local/etc/s
> root    18605  0.0  0.2  1476  804  p0  S+    3:32PM   0:00.00 grep sguil=
d
>
> I try to kill the processes using TERM.
> bash-2.05b# kill -15 17315 17319 17321
>
> As you can see, the child processes were killed, but the parent process
> lives on.
> bash-2.05b# ps -auxw | grep sguild
> root    17315  0.0  0.7  3636 2876  p0- S     5:13AM   0:00.11
> /usr/local/bin/tclsh8.4 /usr/local/bin/sguild -D -c /usr/local/etc/s
> root    18622  0.0  0.2  1476  804  p0  S+    3:33PM   0:00.00 grep sguil=
d
>
> So I try to kill the parent, again and again and again.  It never dies.
> bash-2.05b# kill -15 17315
> bash-2.05b# ps -auxw | grep sguild
> root    17315  0.0  0.7  3636 2876  p0- S     5:13AM   0:00.11
> /usr/local/bin/tclsh8.4 /usr/local/bin/sguild -D -c /usr/local/etc/s
> root    18624  0.0  0.2  1476  804  p0  S+    3:33PM   0:00.00 grep sguil=
d
> bash-2.05b# kill -15 17315
> bash-2.05b# ps -auxw | grep sguild
> root    17315  0.0  0.7  3636 2876  p0- S     5:13AM   0:00.11
> /usr/local/bin/tclsh8.4 /usr/local/bin/sguild -D -c /usr/local/etc/s
>
> If I kill -9, then it dies.  But obviously that's not preferable.  Is it
> possible that the session is doing something that takes a very long time =
to
> complete?  Because, if I wait long enough, it will finally die.
>
> --On Thursday, March 30, 2006 08:13:39 -0700 Bamm Visscher
> <bam...@gm...> wrote:
>
> > I've never seen the issue, but I usually run sguild in the foreground
> > with DEBUG on.
> >
> > Bammkkkk
> >
> >
> > On 3/29/06, Paul Schmehl <pa...@ut...> wrote:
> >> I've run into a problem that I ran into with 0.5.3, and I need to know=
 if
> >> anyone else has seen this as well.  The rc script that I wrote for sgu=
ild
> >> won't stop the process if it's been running for a while.  When I try t=
o
> >> stop it, it claims it's waiting for all three pids.  If I kill the scr=
ipt
> >> and then try to stop again, only the parent pid is still running, but =
the
> >> script cannot kill it.
> >>
> >> Rc scripts  use TERM to kill processes by default.  If I change that t=
o
> >> KILL, it kills the processes immediately.
> >>
> >> Is this something that only I am experiencing?  Or have other people r=
un
> >> into this problem as well?
> >>
> >> Paul Schmehl (pa...@ut...)
> >> Adjunct Information Security Officer
> >> University of Texas at Dallas
> >> AVIEN Founding Member
> >> http://www.utdallas.edu/
> >>
> >>
> >
> >
> > --
> > sguil - The Analyst Console for NSM
> > http://sguil.sf.net
>
>
>
> Paul Schmehl (pa...@ut...)
> Adjunct Information Security Officer
> The University of Texas at Dallas
> http://www.utdallas.edu/ir/security/
>
>


--
sguil - The Analyst Console for NSM
http://sguil.sf.net