inliniac/suricata — pull request #829 by jasonish (2014-02-06 22:50:11+00:00)
Title: Dev log rollover

Preview only.

Here is a first cut and rolling over log files on a signal (SIGHUP). I've added support for fast and eve-log.

The idea is that an external tool like logrotate will rename (not copy) the file, then log rotate will send Suricata the signal, which will cause Suricata to close and reopen the log file to eliminate any chance of loss of a log entry.

Its been a while since I've dealt with proper signal handling on unix. Here we just set a flag on the OutputCtx objects that have registered for notification, and the next time they log something they check for the flag and perform the rotation (should be possible to abstract this a bit more from each type of output).