This is a requirement for the first stable release.
This is a major issue in the current implementation as it currently just quits without sending off/saving events still in the pipeline, leading to data loss of recent events. It also adds significant complexities as the timing behavior for different agents is unknown. Some agents send events as they happen, others wait for them to complete. Some filter chains also wait for a certain time between handling events (to do chunking for instance).
The solution is intended to have good compatibility with systemd.
Questions
Which signal should be caught?
SIGTERM might be appropriate if exit can be done quickly.
SIGINT is appropriate because it's thrown when a user does Ctrl-c
Should we have daemon functionality?
Resources
I've gathered some resources here that are useful when implementing.
This is a requirement for the first stable release.
This is a major issue in the current implementation as it currently just quits without sending off/saving events still in the pipeline, leading to data loss of recent events. It also adds significant complexities as the timing behavior for different agents is unknown. Some agents send events as they happen, others wait for them to complete. Some filter chains also wait for a certain time between handling events (to do chunking for instance).
The solution is intended to have good compatibility with systemd.
Questions
Ctrl-cResources
I've gathered some resources here that are useful when implementing.