Just send "KILL" signal to the worker threads.

[people/stevee/guardian.git] / guardian

diff --git a/guardian b/guardian
index c72a9dcfba993261327a19213cca41c829b952a4..f3c287b593305caf7769618a3439d33c5131cbf8 100644 (file)
--- a/guardian
+++ b/guardian
@@ -27,6 +27,7 @@ use Thread::Queue;
 use Linux::Inotify2;
 use Time::HiRes qw[ time sleep ];
 
+require Guardian::Base;
 require Guardian::Config;
 require Guardian::Parser;
 require Guardian::Socket;
@@ -36,11 +37,6 @@ use warnings;
 # Define version.
 my $version ="2.0";
 
-# Array to store the monitored logfiles.
-my @monitored_files = (
-       "/var/log/snort/alert",
-);
-
 # Get and store the given command line arguments in a hash.
 my %cmdargs = ();
 
@@ -69,6 +65,10 @@ if (defined($cmdargs{"help"})) {
 # Push the may be given config file argument.
 my %mainsettings = &Guardian::Config::UseConfig($cmdargs{"config"});
 
+# Shared hash between the main process and all threads. It will store all
+# monitored files and their current file position.
+my %monitored_files :shared = ();
+
 # Create the main queue. It is used to store and process all events which are
 # reported and enqueued by the worker threads.
 my $queue :shared = new Thread::Queue or die "Could not create new, empty queue. $!\n";;
@@ -114,6 +114,9 @@ sub Init () {
        # Setup IPC mechanism via Socket in an own thread.
        threads->create(\&Socket);
 
+       # Generate hash of monitored files.
+       %monitored_files = &Guardian::Base::GenerateMonitoredFiles(\%mainsettings, \%monitored_files);
+
        # Start worker threads.
        &StartWorkers();
 }
@@ -144,9 +147,6 @@ sub Worker ($) {
        # Signal handler to kill worker.
        $SIG{'KILL'} = sub { threads->exit(); };
 
-       # Get the fileposition.
-       my $fileposition = &Init_fileposition("$file");
-
        # Create inotify watcher.
        my $watcher = new Linux::Inotify2 or die "Could not use inotify. $!\n";
 
@@ -163,6 +163,9 @@ sub Worker ($) {
                if ($watcher->read) {
                        my @message = ();
 
+                       # Obtain fileposition from hash.
+                       my $fileposition = $monitored_files{$file};
+
                        # Open the file.
                        open (FILE, $file) or die "Could not open $file. $!\n";
 
@@ -178,8 +181,13 @@ sub Worker ($) {
                                push (@message, $line);
                        }
 
-                       # Update fileposition.
-                       $fileposition = tell(FILE);
+                       {
+                               # Lock shared hash.
+                               lock(%monitored_files);
+
+                               # Update fileposition.
+                               $monitored_files{$file} = tell(FILE);
+                       }
 
                        # Close file.
                        close(FILE);
@@ -247,35 +255,6 @@ sub Socket () {
        }
 }
 
-#
-## Function for fileposition initialization.
-#
-## This function is used to get the cursor position of the end of file (EOF) of
-## a specified file.
-#
-## In order to prevent from permanently read and keep files opened, or dealing
-## with huge logfiles, at initialization time of the worker processes, the file will
-## be opened once and the cursor position of the end of file (EOF) get stored.
-#
-sub Init_fileposition ($) {
-       my $file = $_[0];
-
-       # Open the file.
-       open(FILE, $file) or die "Could not open $file. $!\n";
-
-       # Just seek to the end of the file (EOF).
-       seek(FILE, 0, 2);
-
-       # Get and store the position.
-       my $position = tell(FILE),
-
-       # Close the file again.
-       close(FILE);
-
-       # Return the position.
-       return $position;
-}
-
 #
 ## Function for capturing process signals.
 #
@@ -286,24 +265,22 @@ sub SignalHandler {
        $SIG{INT} = \&Shutdown;
        $SIG{TERM} = \&Shutdown;
        $SIG{QUIT} = \&Shutdown;
+       $SIG{HUP} = \&Reload;
 }
 
 #
 ## Function to start the workers (threads) for all monitored files.
 #
-## This function will loop through the array of monitored files and will
+## This function will loop through the hash of monitored files and will
 ## spawn an own thread based worker for each file. Every created worker will
 ## be added to the array of running workers.
 #
 sub StartWorkers () {
-       # Loop through the array of which files should be monitored and
-       # create a worker thread for each single one.
-       foreach my $monitored_file (@monitored_files) {
-               # Check if the file exists and is readable.
-               if (-r "$monitored_file") {
-                       # Create worker thread for the file.
-                       push @running_workers, threads->create(\&Worker,$monitored_file);
-               }
+       # Loop through the hash which contains the monitored files and start
+       # a worker thread for each single one.
+       foreach my $file (keys %monitored_files) {
+               # Create worker thread for the file.
+               push @running_workers, threads->create(\&Worker,$file);
        }
 }
 
@@ -318,10 +295,31 @@ sub StopWorkers () {
        foreach my $worker (@running_workers) {
                # Send the worker the "KILL" signal and detach the
                # thread so perl can do an automatically clean-up.
-               $worker->kill('KILL')->detach();
+               $worker->kill('KILL');
        }
 }
 
+#
+## Reload function.
+#
+## This function will get called if the signal handler recieves a "SIGHUP" signal,
+## or the reload command will be sent via socket connection. It is responsible for
+## reloading all configure options and stopping/starting the worker threads.
+#
+sub Reload () {
+       # Stop all running workers.
+       &StopWorkers();
+
+       # Re-read configuration file.
+       %mainsettings = &Guardian::Config::UseConfig($cmdargs{"config"});
+
+       # Re-generate hash of monitored files.
+       %monitored_files = &Guardian::Base::GenerateMonitoredFiles(\%mainsettings, \%monitored_files);
+
+       # Restart the worker threads.
+       &StartWorkers();
+}
+
 #
 ## Shutdown function.
 #
@@ -335,6 +333,11 @@ sub Shutdown () {
        # Remove socket file on exit.
        &Guardian::Socket::RemoveSocketFile();
 
+       # Sleep for one second to give perl some
+       # time to proper clean up everything before
+       # exiting.
+       sleep(1);
+
        # Exit guardian.
        exit;
 }