Merge remote-tracking branch 'origin/topic/seth/fix-raw-reader-subprocess-exit'

* origin/topic/seth/fix-raw-reader-subprocess-exit:
  Fix an issue with raw reader culling streams for dead processes.

Updated the 'exec' utility to no longer remove input streams for
processes that are finished as the core C++ code will take care of that
(and trying to remove a stream multiple times emits a warning message).

CHANGES

@@ -1,4 +1,8 @@
 
+2.5-996 | 2018-09-11 13:04:20 -0500
+
+  * Fix raw input reader not removing streams for dead processes. (Seth Hall, Corelight)
+
 2.5-994 | 2018-09-10 19:47:03 -0500
 
   * Try to fix a rare broker test instability (Jon Siwek, Corelight)

VERSION

@@ -1 +1 @@
-2.5-994
+2.5-996

scripts/base/utils/exec.bro

@@ -131,7 +131,9 @@ event InputRaw::process_finished(name: string, source:string, exit_code:count, s
 	if ( name !in pending_commands )
 		return;
 
-	Input::remove(name);
+	# Upon the process exiting, the internal Raw reader code should take
+	# care of signalling that the stream needs to be disabled/removed.
+	#Input::remove(name);
 	results[name]$exit_code = exit_code;
 	results[name]$signal_exit = signal_exit;
 

src/input/readers/raw/Raw.cc

@@ -691,6 +691,7 @@ bool Raw::DoUpdate()
 			EndCurrentSend();
 
 		SendEvent("InputRaw::process_finished", 4, vals);
+		return false;
 		}