localfile command frequency is ignored when logcollector restarts

[ghost]

When restarted, logcollector will run the command below unconditionally, effectively ignoring the frequency element:

  <localfile>
    <log_format>full_command</log_format>
    <command>head -1 /var/lib/securedrop/submissions_today.txt | grep '^[0-9]*$'</command>
    <frequency>86400</frequency>
  </localfile>

When logcollector starts, the logff[i]->size field is set to zero

        else if(strcmp(logff[i].logformat, "command") == 0)
        {
            logff[i].file = NULL;
            logff[i].fp = NULL;
            logff[i].size = 0;

and the daemon loop checks this field to compare it with the current time

        /* Checking which file is available */
        for(i = 0; i <= max_file; i++)
        {
            if(!logff[i].fp)
            {
                /* Run the command. */
                if(logff[i].command && (f_check %2))
                {
                    curr_time = time(0);
                    if((curr_time - logff[i].size) >= logff[i].ign)
                    {
                        logff[i].size = curr_time;
                        logff[i].read(i, &r, 0);
                    }
                }
                continue;
            }

[ddpbsd]

This problem only exists on startup? If ossec-logcollector is running for a while, it uses the frequency properly? If I'm misunderstand the issue, the rest of my post doesn't apply.

Frequency isn't something that's recorded at shutdown. I don't think it would be difficult to track this state between shutdown and startup, but it wasn't really on my roadmap.

[ghost]

This problem only exists on startup?

Yes.

[ghost]

@ddpbsd thanks for the confirmation. Knowing it works this way is helpful: I thought maybe I missed something ;-)