# broctl restart

**URL:** <https://community.zeek.org/t/broctl-restart/2591>\
**Category:** Development\
**Tags:** development\
**Created:** [March 18, 2013, 3:37pm UTC](https://community.zeek.org/t/broctl-restart/2591 "2013-03-18T15:37:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [March 18, 2013, 3:37pm UTC](https://community.zeek.org/t/broctl-restart/2591/1 "2013-03-18T15:37:31Z")

</div>

Daniel,

I've a question/task regarding broctl' "restart". Before merging #960,  
there was this code:

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if clean:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# Can't delete the tmp here because log archival might still be  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# going on there in the background.  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;util.output("cleaning up ...")  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;self.do\_cleanup("--keep-tmp " + args)  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;self.postcmd(False, "--keep-tmp " + args)

You removed the --keep-tmp option, which makes sense because it didn't  
do anything. However, I'm concerned that that might have been there  
for a reason, per the comment (which I've removed now too because  
without the --keep-tmp, it doesn't apply anymore).

Is is possible that we still have a problem there that if somebody  
does "restart --clean", logs might get deleted before they're  
completely archived? I'm wondering if the --keep-tmp code might have  
just gotten lost at some point accidentally.

Also, maybe related or not, we got a report that "broctl restart"  
(without --clean) apparently \*does\* delete logs occasionally before  
they get archived. So independent of --keep-tmp, I'm wondering if we  
have some a similar problem elsewhere.

Can you take a closer look at these and see if you find something?  
I'll also open a ticket. Thanks,

Robin

---

<div class="post-metadata">

**Author:** ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)\
**Post date:** [March 20, 2013, 4:46pm UTC](https://community.zeek.org/t/broctl-restart/2591/2 "2013-03-20T16:46:02Z")

</div>

> Daniel,
> 
> I've a question/task regarding broctl' "restart". Before merging #960,  
> there was this code:
> 
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if clean:  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# Can't delete the tmp here because log archival might still be  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# going on there in the background.  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;util.output("cleaning up ...")  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;self.do\_cleanup("--keep-tmp " + args)  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;self.postcmd(False, "--keep-tmp " + args)
> 
> You removed the --keep-tmp option, which makes sense because it didn't  
> do anything. However, I'm concerned that that might have been there  
> for a reason, per the comment (which I've removed now too because  
> without the --keep-tmp, it doesn't apply anymore).
> 
> Is is possible that we still have a problem there that if somebody  
> does "restart --clean", logs might get deleted before they're  
> completely archived? I'm wondering if the --keep-tmp code might have  
> just gotten lost at some point accidentally.

I'm guessing the do\_cleanup() code previously deleted tmp  
unless the "--keep-tmp" option was specified. Currently, that  
code does not delete tmp unless the "--all" option is  
given (which cannot happen when the user runs the "restart"  
command, even if the user erroneously tries to use the "--all"  
option with the "restart" command). So, I don't see any problem  
here.

> Also, maybe related or not, we got a report that "broctl restart"  
> (without --clean) apparently \*does\* delete logs occasionally before  
> they get archived. So independent of --keep-tmp, I'm wondering if we  
> have some a similar problem elsewhere.

I've found a race condition that occurs when the "stop" command  
is issued which can result in log files being deleted before  
they're archived into the "logs/\<date\>" directory (since "restart"  
first does a "stop", I don't see any problem with the "restart"  
command itself).

In my testing, I've seen only the conn.log being deleted before it  
is archived, because it takes longer to archive conn.log due to the  
summarize-connections postprocessor that gets run by the archive-log  
script (as a quick test, I tried skipping the connection summary  
processing by setting tracesummary="" in broctl.cfg, and this  
resulted in conn.log being reliably archived with each "broctl stop").

I will post more details to ticket #970 in the tracker.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/broctl-restart/2591/3 "2022-05-06T15:40:50Z")

</div>


