From caab893fbef176a86404c1a6a4c897cfd607778d Mon Sep 17 00:00:00 2001
From: Seth Hall <seth@corelight.com>
Date: Tue, 11 Sep 2018 11:21:31 -0400
Subject: [PATCH] Fix an issue with raw reader culling streams for dead
 processes.

Input streams weren't being reaped when the raw reader was running
a subprocess and the subprocess died.  The subprocess would still
go away from Bro would never get rid of the input stream.
---
 src/input/readers/raw/Raw.cc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/input/readers/raw/Raw.cc b/src/input/readers/raw/Raw.cc
index e41e4e77ac..51b041744c 100644
--- a/src/input/readers/raw/Raw.cc
+++ b/src/input/readers/raw/Raw.cc
@@ -691,6 +691,7 @@ bool Raw::DoUpdate()
 			EndCurrentSend();
 
 		SendEvent("InputRaw::process_finished", 4, vals);
+		return false;
 		}