Re: stopping multilog

richard lucassen wrote:

> I run a process which writes data through multilog. Each 5 minutes, I
> need to process the collected data and start with a new "current"
> sending an ALARM signal to the multilog process. This will certainly
> work:
> 
> command ./main/current
> svc -a ./

As you noted, this is a classic race condition as current could get written
to while processing.  So instead, you could rotate first and then process
the last tai64 timestamp file generated:

svc -a ./
sleep 1
command $(ls -t ./main/@400* | head -1)

The sleep 1 is required as the signal delivery is asynchronous, and multilog
will require "some time" to rotate the file.  For safety's sake it might be
worth having the script track if it's processed this timestamp file before,
or it's a file that's been produced in the last few seconds.

As Paul noted, multilog is also a good idea, provided processing doesn't
take very long (as multilog will pause while processing is occurring,
potentially blocking your monitored process), *or* you don't mind the wait
that processing may produce.


-- 
Regards,
  Daryl Tester

"A long time ago, I stopped thinking that 'User must click OK to
 scary-looking message' was any sort of road bump for malware."
  -- Valdis Kletnieks