Hi Mika,
On 7/1/21 3:05 PM, Mika Silander wrote:
Returning to a similar issue but from a different angle: for maintenance I'd like to be able to cleanly shutdown the server running intelmq. Is there a way to guarantee that none of the bots is in a processing state (i.e. processing an event in the process method) before server shutdown? Can "intelmqctl stop" for example stop the bot chain in such a way that none of the bots is in the midst of processing an event? If not, what would be the best approach for achieving this?
I have two answer to offer:
The kill signal is destructive and interrupts syscalls. So after the reception, the bot cannot just continue where it stopped. As far as I know it's currently not possible to circumvent this except for threading, where the main thread receives the signal and then could wait for the other threads finish processing. Would be a cool feature :) Related feature request (of myself): https://github.com/certtools/intelmq/issues/1298
The other answer is: You may simply ignore this. You won't loose any data, as the message on the input side is only deleted after the message is processed completely and sent to the next queue. But you can end up with messages being duplicated, especially if you kill a parser which is just parsing a large report. It could happen for all bots in principle, if you kill them after they sent the message and just before they acknowledged it - but I consider that very improbable. You can prevent this by placing another deduplicator just before your output bot(s).
I assume these are not the answers you were looking for and hope they don't spoil your mood just before the weekend =)
best regards Sebastian