HostedDB - Dedicated UNIX Servers

-->
Internet Security Professional Reference:Understanding and creating
Previous Table of Contents Next


Handling Input and Output

As with the shell, PERL uses the same three standard input and output files: standard input, known as STDIN; standard output, known as STDOUT; and standard error, known as STDERR. Another similarity with the shell is the method of writing information into these streams. The printing of information to an open file descriptor such as STDOUT is accomplished by using the PERL command print or printf, as shown in this example.

printf STDOUT "This is a test\n";
}

The PERL language has a C language syntax for many of its commands. The preceding example prints the text “This is a test” followed by a newline on the standard output device. To print the same message only on standard error, use the command:

printf STDERR "This is a test\n";
}

Any file descriptor or file handle name can be used in place of STDOUT and STDERR, provided it has been opened for write first. If the corresponding file has not been opened, the text cannot be seen anywhere.

It may also be necessary to close one or more of the standard I/O streams to prevent unwanted text from “leaking” into places where it is not desired. A good programmer would not allow this to happen anyway. To close a file descriptor such as STDOUT in PERL, use the following command:

close(STDOUT);
}

If these standard I/O file descriptors are not needed to communicate with the “outside” world, then they can be closed. This means that all output from the program must be directed specifically to the location where you want it to go.

Handling Signals

Handling the types of signals that can be generated by this daemon must be included in the PERL program. Failure to capture the signals may result in the program terminating early for an unknown reason. If, for example, your program uses pipe to communicate with other programs, it may terminate abnormally if the other program wasn’t ready. Catching the SIGPIPE signal will prevent the program from terminating.

Trapping a signal in PERL requires that you write a signal handler to respond to the signal, or set it to be ignored, as in the following example:

$SIG{"PIPE"} = "IGNORE";    # signal value 13
}

In this case, the SIGPIPE signal will be ignored. This means that if the program receives a signal SIGPIPE, it is ignored and does not cause the program to terminate.

The procmon Program

The procmon program is a PERL script that is started during system startup and runs for the life of the system. It has been written to be a system daemon, and it behaves as such. The purpose of this program is to monitor the operation of a set of defined processes; if they are not present in the process list, procmon restarts them. This daemon is also designed to log its actions, such as when the process fails and the time it is restarted. A sample of procmon’s monitoring log, created by using the Unix syslog facility, is shown here:

Feb 20 07:31:21 nic procmon[943]: Process Monitor started
Feb 20 07:31:21 nic procmon[943]: Loaded config file /etc/procmon.cfg
Feb 20 07:31:22 nic procmon[943]: Command File: /etc/procmon.cmd
Feb 20 07:31:22 nic procmon[943]: Loop Delay = 300
Feb 20 07:31:22 nic procmon[943]: Adding named  to stored process list
Feb 20 07:31:22 nic procmon[943]: Monitoring: 1 processes
Feb 20 07:31:22 nic procmon[943]: named  running as PID 226
Feb 20 07:36:22 nic procmon[943]: named  running as PID 226
Feb 20 07:41:23 nic procmon[943]: named  running as PID 226

This syslog output shows procmon as it starts and records what it is doing with named. This setup is helpful for troubleshooting. You need to have as much logging information as possible about the process you were monitoring.

The benefit of a program such as this one is most noticeable when the program is started at system boot time. How the program starts depends on the Unix variant you are using. On System V systems, the command line shown here is added to /etc/rc2 or to a file in /etc/rc2.d directory, which is the preferred method. BSD-based systems use the same command, but in the /etc/rc.local directory.

/usr/local/bin/procmon &

procmon is in fact a daemon process. It handles all the system signals, and disconnects itself from a controlling terminal. When procmon starts, it prints a line indicating what configuration parameters it is using, and then quietly moves to the background. All logging at this point is performed by the Unix syslog facility. The output that is printed when using the procmon.cmd file is as follows:

Found /etc/procmon.cfg … loading …

When using the program defaults, this is what you will see:

no config file… using defaults …

Two configuration files are used by procmon: procmon.cfg and procmon.cmd. Only the procmon.cmd file is absolutely necessary. If procmon.cfg exists, it will be used to alter the base configuration of the program.

The default configuration file is /etc/procmon.cfg. If this file is not found when procmon starts, it uses the default parameters built into the program. This configuration file enables the system administrator to change the location of the procmon.cmd file and to change the delay between checking the commands in the list.

If no /etc/procmon.cfg file is found, procmon uses the /etc directory to look for the procmon.cmd file, and a default delay of five minutes between checks. Notice that the delay value is in seconds not minutes. The /etc/procmon.cfg file is processed by procmon, and the needed values are checked for validity before they are used. This means that comments using the “#” symbol are supported, so long as “#” is the first character on the line. The procmon.cfg file is shown as follows:

#
# Configuration file for procmon.
#
#
# 5 minute delay
#
delay_between = 300;
#
# where is the process list file?
#
ConfigDir = "/etc";

The reason for the use of this configuration file is so that the parameters of the program can be modified without the need to change the source code. The delay_between variable is used to define the amount of delay between processing the list of commands. For example, if the delay_between variable is 300, a pause of 300 seconds takes place between processing.

The ConfigDir variable tells procmon where the procmon.cmd file is located. procmon defaults to /etc.

Whereas it is possible to use the PERL require command to instruct PERL to read the named file, procmon.cfg, into the current program, this can cause potential security problems. If the configuration file is attacked, for example, a PERL program could be put into place by the wily hacker, thereby granting them access to the system.


Previous Table of Contents Next