Indeed, unlike on BSD systems, signals under Linux are reset to their
default behavior when raised.
I've put a new release of hf here:
It uses the setsignal() routine I wrote for tcpdump that addresses the
various behaviors of signal(). I believe under linux it uses
sigaction() to setup a persistent signal handler.
My only linux died mysteriously a few months ago and resited attempts
to reinstall the OS so I can't easily test this change; so if it tests
out ok, please let us know so Vern can include this version of hf in
the next bro distribution.
Craig