Re: [Sguil-devel] Problems killing sguild

[Bamm V. <bam...@gm...>]

Can you send me the output of `ps auxw | grep sguild`  for each of
these tests (once immediately after you start and once immediately
after the kill and before you kill -9 it).

Bammkkkk


On Mon, Apr 14, 2008 at 12:52 PM, Paul Schmehl <pa...@ut...> wrote:
> --On Monday, April 14, 2008 09:25:05 -0600 Bamm Visscher
>
> <bam...@gm...> wrote:
>
>  > To clarify, the problem you siee is that you kill sguild with SIGTERM
>  > and two of the processes exit immediately, but one (the main sguild
>  > process) continues to run for a period of time before it exits?
>  >
>
>  Here's a normal start of sguild, using my port:
>
>  [root@buttercup3 ~]# /usr/local/etc/rc.d/sguild start
>  Starting sguild.
>  [root@buttercup3 ~]# /usr/local/etc/rc.d/sguild status
>  sguild is running as pid 76314 76319 76320.
>
>  Here's a normal restart:
>
>  [root@buttercup3 ~]# /usr/local/etc/rc.d/sguild restart
>  Stopping sguild.
>  SGUILD: killing child procs...
>  SGUILD: Exiting...
>  Waiting for PIDS: 76314 76319.
>  Starting sguild.
>
>  (Notice that one child is already dead.  The other one dies shortly afterward.
>  Then the parent dies.)
>
>  Now here's what happens after sguild has been running for several hours:
>
>  [root@buttercup3 ~]# /usr/local/etc/rc.d/sguild restart
>  Stopping sguild.
>  SGUILD: killing child procs...
>  SGUILD: Exiting...
>  Waiting for PIDS: 76314 76319 76314 76314 76314 76314 76314 76314 76314 76314
>  76314 76314 76314 76314 76314 76314 76314 76314 76314 76314 76314 76314 76314
>  76314 76314 76314 76314 76314 76314 76314 76314 76314 76314 76314 76314 76314
>  76314 76314 76314 76314 76314 76314 76314 76314 76314 76314 76314 76314 76314
>  76314 76314 76314 76314 76314 76314 76314 76314 76314 76314 76314 76314 76314
>  76314 76314 76314 76314 76314 76314 76314 76314 76314 76314 76314 76314 76314
>  76314 76314 76314 76314 76314
>
>  And on and on forever.  You have to use kill SIGKILL (signal 9) to stop the
>  process after that.  The normal way to kill a process is to use SIGTERM (signal
>  15) to kill a process, which allows it to shut down gracefully.  But, for some
>  reason, after sguild has been running for a while the parent refuses to die.
>
>  (Notice that the second child shows up once but then goes away, but the parent
>  lingers on forever.)
>
>  --
>
>
> Paul Schmehl (pa...@ut...)
>  Senior Information Security Analyst
>  The University of Texas at Dallas
>  http://www.utdallas.edu/ir/security/
>
>
>  -------------------------------------------------------------------------
>  This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
>  Don't miss this year's exciting event. There's still time to save $100.
>  Use priority code J8TL2D2.
>  http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
>  _______________________________________________
>  Sguil-devel mailing list
>  Sgu...@li...
>  https://lists.sourceforge.net/lists/listinfo/sguil-devel
>



-- 
sguil - The Analyst Console for NSM
http://sguil.sf.net