ascii logger: unexpected modification to default_rotation_postprocessor_cmd and default_rotation_date_format during runtime

Zeek
1

Hi!

I noticed a strange behavior: my bro 2.5.3 running on Linux for about 15
days suddenly "forgot" my settings for
Log::default_rotation_postprocessor_cmd and
Log::default_rotation_date_format.

When the change happened, the rotated files piled up, because the
post-processing script was not started. Also the filenames did no
longer contain the time zone. (I use Log::default_rotation_date_format =
%Y-%m-%d-%H-%M-%S%Z to avoid file name collisions when switching
to/from daylight-saving time).

A quick look at the code was not enough to understand the way rotation
works. I can spend more time, if nobody comes up with an explanation. I
can only assume, that some internal error in bro resets the values
without an error showing up (or the error was lost in bro's tmux
session).

Restarting bro helped for now.

Thanks for any ideas.

Franky.

2

This has been a long standing bug that only ever seems to express itself on heavily loaded systems but generally seems to be somewhat rare. We haven't been able to find the exact bug yet, but some of us have known about it for quite a while. It would help if we could reproduce it reliably, but I suspect that in order to reproduce it we need to fully understand it first. :slight_smile:

   .Seth

3

Hi!