diff --git a/CHANGES b/CHANGES index 1d18df4254..d291fbb8b0 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,8 @@ +2.5-996 | 2018-09-11 13:04:20 -0500 + + * Fix raw input reader not removing streams for dead processes. (Seth Hall, Corelight) + 2.5-994 | 2018-09-10 19:47:03 -0500 * Try to fix a rare broker test instability (Jon Siwek, Corelight) diff --git a/VERSION b/VERSION index 7df0fdb36b..13a72acaaf 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.5-994 +2.5-996 diff --git a/scripts/base/utils/exec.bro b/scripts/base/utils/exec.bro index 5079396bbc..37668c0bc6 100644 --- a/scripts/base/utils/exec.bro +++ b/scripts/base/utils/exec.bro @@ -131,7 +131,9 @@ event InputRaw::process_finished(name: string, source:string, exit_code:count, s if ( name !in pending_commands ) return; - Input::remove(name); + # Upon the process exiting, the internal Raw reader code should take + # care of signalling that the stream needs to be disabled/removed. + #Input::remove(name); results[name]$exit_code = exit_code; results[name]$signal_exit = signal_exit; diff --git a/src/input/readers/raw/Raw.cc b/src/input/readers/raw/Raw.cc index e41e4e77ac..51b041744c 100644 --- a/src/input/readers/raw/Raw.cc +++ b/src/input/readers/raw/Raw.cc @@ -691,6 +691,7 @@ bool Raw::DoUpdate() EndCurrentSend(); SendEvent("InputRaw::process_finished", 4, vals); + return false; }