[IntelMQ-dev] Bot behaviour in case of unrecoverable errors

[Sebastian Wagner]

Dear Mika,

On 2/16/21 11:58 AM, Mika Silander wrote:
>  Thanks for answering. I've been busy with other things so np with a delayed answer.
> What comes to my question on how to react when a bot "dies", I see the question should be rephrased
> as "how to react to exceptions in a bot?". The error handling URL below suggests
> that I could set the parameter error_procedure (+ error_max_retries + error_retry_delay), and that should cover
> what is needed especially if a restart after this requires manual operation.
What is your aim? If you say how you want IntelMQ to behave, I can
suggest you specific settings. The defaults should be sane already,
aside from the fact that stopped components are not automatically
restarted (but that's the same behavior as for systemd/... services as
well).
> And I can discard the (elaborate) option of making the bot always analyze its own log entries
> (to discover repetitive failures/exceptions) at startup.

Yes, that's not necessary. If you want to keep an eye on the logs and
errors yourself, take a look at the logcheck rule set:

https://github.com/certtools/intelmq/tree/develop/contrib/logcheck

best regards
Sebastian

-- 
// Sebastian Wagner <wagner at cert.at> - T: +43 1 5056416 7201
// CERT Austria - https://www.cert.at/
// Eine Initiative der nic.at GmbH - https://www.nic.at/
// Firmenbuchnummer 172568b, LG Salzburg


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.cert.at/pipermail/intelmq-dev/attachments/20210216/99360dff/attachment.sig>