Skip to content
This repository has been archived by the owner on Feb 15, 2024. It is now read-only.

Protect output file updates from potential concurrent access #7

Closed
atc0005 opened this issue Jan 26, 2020 · 4 comments · Fixed by #30
Closed

Protect output file updates from potential concurrent access #7

atc0005 opened this issue Jan 26, 2020 · 4 comments · Fixed by #30
Assignees
Milestone

Comments

@atc0005
Copy link
Owner

atc0005 commented Jan 26, 2020

The goal is to allow simultaneous submissions from Splunk and other sources, but single batch de-duped writes to an output file. The goal is to prevent race conditions when appending to an existing output file.

@atc0005 atc0005 changed the title Add support for simultaneous requests, single-threaded output Add support for simultaneous requests, single-wroter output Jan 26, 2020
@atc0005 atc0005 changed the title Add support for simultaneous requests, single-wroter output Add support for simultaneous requests, single-writer output Jan 26, 2020
@atc0005
Copy link
Owner Author

atc0005 commented Jan 26, 2020

Channels? The Effective Go guide seems to suggest this approach.

@atc0005
Copy link
Owner Author

atc0005 commented Mar 6, 2020

Channels? The Effective Go guide seems to suggest this approach.

(I think) that one workaround would be to use a read/write mutex. A write-only mutex wouldn't work because we'll need to ensure that all "writers" see the same existing data in order to not attempt writing out a new entry to a flat-file if another writer has an update queued up to add the same user account.

Another approach (likely better) is to use a queue for "block user" events and a single goroutine to process that queue. I assume that at least a write mutex would still be needed in case multiple copies of the app run simultaneously (for whatever reason), but needing to lock on read wouldn't apply any more?

@atc0005 atc0005 added this to the v0.1.0 milestone May 3, 2020
@atc0005 atc0005 self-assigned this May 3, 2020
@atc0005
Copy link
Owner Author

atc0005 commented May 3, 2020

Another approach (likely better) is to use a queue for "block user" events and a single goroutine to process that queue.

This same approach should also work well for concurrent access to a database where a potential high-volume, but low speed requirement would apply. Using a queue approach should help alleviate issues with file-based databases like SQLite where concurrent write access would (at best) prove unreliable.

I assume that at least a write mutex would still be needed in case multiple copies of the app run simultaneously (for whatever reason), but needing to lock on read wouldn't apply any more?

Does a write mutex apply at the OS level, or only the application? If only the application, then there isn't any additional protection applied aside from having a file open at the time another application (or another application instance) wants to write to it.

@atc0005
Copy link
Owner Author

atc0005 commented May 7, 2020

Unless things change as development moves further along, I've opted to use a mutex for flat-file access instead of implementing queues via channels. I may still use that approach as I did with the atc0005/bounce project once Teams notifications support is wired in.

@atc0005 atc0005 changed the title Add support for simultaneous requests, single-writer output Protect output file updates from potential concurrent access May 23, 2020
atc0005 added a commit that referenced this issue May 23, 2020
Features of the initial prototype release:

- Highly configurable (with more configuration choices to be exposed
  in the future)

- Supports configuration settings from multiple sources
  - command-line flags
  - environment variables
  - configuration file
  - reasonable default settings

- Ignore individual usernames (i.e., prevent disabling listed accounts)
- Ignore individual IP Addresses (i.e., prevent disabling associated
  account)

- User configurable logging settings
  - levels, format and output

- Microsoft Teams notifications
  - generated for multiple events
    - alert received
    - disabled user
    - ignored user
    - ignored IP Address
    - error occurred
  - configurable retries
  - configurable notifications delay in order to respect remote API
    limits

- Logging
  - Payload receipt from monitoring system
  - Action taken due to payload
    - username ignored
      - due to username inclusion in ignore file for usernames
      - due to IP Address inclusion in ignore file for IP Addresses
    - username disabled

- contrib files/content provided to allow for spinning up a demo
   environment in order to provide a hands-on sense of what this
   project can do
  - fail2ban
  - postfix
  - docker
    - Maildev container
  - brick
  - rsyslog
  - systemd
  - sample JSON payloads for use with curl or other http/API clients
  - demo environment doc
  - slides from group presentation/demo

Worth noting:

- Go modules (vs classic GOPATH setup)
- GitHub Actions Workflows which apply linting and build checks
- Makefile for general use cases (including local linting)
  - Note: See README first if building on Windows

refs:

- GH-26
- GH-21
- GH-16
- GH-15
- GH-13
- GH-12
- GH-11
- GH-7
- GH-6
- GH-4
- GH-1
atc0005 added a commit that referenced this issue May 23, 2020
Features of the initial prototype release:

- Highly configurable (with more configuration choices to be exposed
  in the future)

- Supports configuration settings from multiple sources
  - command-line flags
  - environment variables
  - configuration file
  - reasonable default settings

- Ignore individual usernames (i.e., prevent disabling listed accounts)
- Ignore individual IP Addresses (i.e., prevent disabling associated
  account)

- User configurable logging settings
  - levels, format and output

- Microsoft Teams notifications
  - generated for multiple events
    - alert received
    - disabled user
    - ignored user
    - ignored IP Address
    - error occurred
  - configurable retries
  - configurable notifications delay in order to respect remote API
    limits

- Logging
  - Payload receipt from monitoring system
  - Action taken due to payload
    - username ignored
      - due to username inclusion in ignore file for usernames
      - due to IP Address inclusion in ignore file for IP Addresses
    - username disabled

- contrib files/content provided to allow for spinning up a demo
   environment in order to provide a hands-on sense of what this
   project can do
  - fail2ban
  - postfix
  - docker
    - Maildev container
  - brick
  - rsyslog
  - systemd
  - sample JSON payloads for use with curl or other http/API clients
  - demo environment doc
  - slides from group presentation/demo

Worth noting:

- Go modules (vs classic GOPATH setup)
- GitHub Actions Workflows which apply linting and build checks
- Makefile for general use cases (including local linting)
  - Note: See README first if building on Windows

refs:

- GH-26
- GH-21
- GH-16
- GH-15
- GH-13
- GH-12
- GH-11
- GH-7
- GH-6
- GH-4
- GH-1
atc0005 added a commit that referenced this issue May 23, 2020
Features of the initial prototype release:

- Highly configurable (with more configuration choices to be exposed
  in the future)

- Supports configuration settings from multiple sources
  - command-line flags
  - environment variables
  - configuration file
  - reasonable default settings

- Ignore individual usernames (i.e., prevent disabling listed accounts)
- Ignore individual IP Addresses (i.e., prevent disabling associated
  account)

- User configurable logging settings
  - levels, format and output

- Microsoft Teams notifications
  - generated for multiple events
    - alert received
    - disabled user
    - ignored user
    - ignored IP Address
    - error occurred
  - configurable retries
  - configurable notifications delay in order to respect remote API
    limits

- Logging
  - Payload receipt from monitoring system
  - Action taken due to payload
    - username ignored
      - due to username inclusion in ignore file for usernames
      - due to IP Address inclusion in ignore file for IP Addresses
    - username disabled

- contrib files/content provided to allow for spinning up a demo
   environment in order to provide a hands-on sense of what this
   project can do
  - fail2ban
  - postfix
  - docker
    - Maildev container
  - brick
  - rsyslog
  - systemd
  - sample JSON payloads for use with curl or other http/API clients
  - demo environment doc
  - slides from group presentation/demo

Worth noting:

- Go modules (vs classic GOPATH setup)
- GitHub Actions Workflows which apply linting and build checks
- Makefile for general use cases (including local linting)
  - Note: See README first if building on Windows

refs:

- GH-26
- GH-21
- GH-16
- GH-15
- GH-13
- GH-12
- GH-11
- GH-7
- GH-6
- GH-4
- GH-1
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant