Issue when restarting grok

[supernico]

Hi, I'm using grok on FreeBSD 6.2 installed from ports.

The issue I got is grok stops working if I restart it. grok process
seems to stop and start OK but this is what I get after a few /usr/
local/etc/rc.d/grok restart :

root 921 0,0 0,1 1708 812 ?? I 10jui07 0:00,01 sh -c
tail -0f '/var/log/xferlog'
root 923 0,0 0,1 1284 636 ?? I 10jui07 0:00,01 tail
-0f /var/log/xferlog
root 2589 0,0 0,1 1708 840 ?? I 24jui07 0:00,01 sh -c
tail -0f '/var/log/auth.log'
root 2592 0,0 0,1 1284 592 ?? I 24jui07 0:00,04 tail
-0f /var/log/auth.log
root 94944 0,0 0,1 1708 1000 ?? I Ven19 0:00,01 sh -c
tail -0f '/var/log/xferlog'
root 94945 0,0 0,1 1708 1000 ?? I Ven19 0:00,01 sh -c
tail -0f '/var/log/auth.log'
root 94946 0,0 0,1 1284 616 ?? I Ven19 0:00,02 tail
-0f /var/log/xferlog
root 94948 0,0 0,1 1284 616 ?? I Ven19 0:00,04 tail
-0f /var/log/auth.log
root 50462 0,0 0,1 1860 1256 p2 I+ 0:05 0:00,01 sh -c
tail -0f '/var/log/xferlog'
root 50463 0,0 0,1 1280 612 p2 I+ 0:05 0:00,00 tail
-0f /var/log/xferlog
root 50464 0,0 0,1 1860 1256 p2 I+ 0:05 0:00,01 sh -c
tail -0f '/var/log/auth.log'
root 50465 0,0 0,1 1280 612 p2 I+ 0:05 0:00,00 tail
-0f /var/log/auth.log

I think that's why grok stop matching patterns after a restart.

Also, I don't know if you are the freebsd port maintainer too but when
using the rc.d script to start grok I get :

/usr/local/etc/rc.d/grok: WARNING: $command_interpreter /usr/local/bin/
perl != /usr/bin/perl

Either the interpreter in the rc.d script should be /usr/bin/perl or
the grok on be /usr/local/bin/perl.

Thanks for your work, gork is really nice when working :)

[Jordan Sissel]

+wxs, who is the port maintainer (I think?)

Replies inline.

Sorry for the delay in response, didn't see this email :)

I don't see why that would particularly cause grok to fail after a restart. Those tasks are sticking around because grok bleeds  processes when shutdown in strange ways , unfortunately.

Can you run it with a higher loglevel when you restart it and post the output here?

-Jordan

[Wesley Shields]

On Tue, Aug 07, 2007 at 10:59:00AM -0700, Jordan Sissel wrote:
> +wxs, who is the port maintainer (I think?)

Yes, I'm the maintainer. :)

Are you saying the shutdown using the rc script causes the process
bleeding, or just killing grok? I seem to recall testing the rc script
shutdown pretty extensively when I wrote it and don't recall having this
problem.

Based upon the description above he claims to be using the rc script
which should not be causing this bleeding. I'll have to test it out and
get back to you.

> Can you run it with a higher loglevel when you restart it and post the
> output here?
>
> -Jordan
>
> Also, I don't know if you are the freebsd port maintainer too but when
> > using the rc.d script to start grok I get :
> >
> > /usr/local/etc/rc.d/grok: WARNING: $command_interpreter /usr/local/bin/
> > perl != /usr/bin/perl

I've known about this problem for a while and it's because of the
variable substitution that is done in the script by the ports
framework. The ports framework substitutes ${PREFIX}/bin/perl for
%%PERL%% in the rc script, but the grok script is using /usr/bin/perl.
Technically I should patch grok to use ${PREFIX}/bin/perl to fix this,
but it is entirely harmless.

> > Either the interpreter in the rc.d script should be /usr/bin/perl or
> > the grok on be /usr/local/bin/perl.

You are right, but since the rc script is using /usr/local/bin/perl and
grok is using /usr/bin/perl (which should be a symlink to
/usr/local/bin/perl) this is an entirely harmless warning.

> > Thanks for your work, gork is really nice when working :)

All the credit goes to Jordan for sure. :)

-- WXS