[resolved] recorded events have 0.0 duration

[c0ldfusi0nz]

just wanted to post this in case others encounter the same problem. i posted earlier asking how to record x seconds before and after an alarm and was told to adjust the pre and post event image count buffer sizes for the monitor. it turns out that if you make them too large (and i had already set a large shared kernel memory value) then you see this 'exit status 40' error code when an alarm event fires:

Code: Select all

tail -f /tmp/zm*.log:

/tmp/zmdc.log:
03/28/10 18:02:22.338891 zmdc[5762].ERR ['zma -m 1' exited abnormally, exit status 40]
03/28/10 18:02:22.339124 zmdc[5762].INF [Starting pending process, zma -m 1]
03/28/10 18:02:22.340000 zmdc[5762].INF ['zma -m 1' starting at 10/03/28 18:02:22, pid = 32681]
03/28/10 18:02:28.448295 zmdc[5762].ERR ['zma -m 1' exited abnormally, exit status 40]
03/28/10 18:02:31.494118 zmdc[5762].INF ['zma -m 1' starting at 10/03/28 18:02:31, pid = 32683]

/tmp/zmwatch.log:
03/28/10 18:02:31.362369 zmwatch[5794].INF [Restarting analysis daemon for front_door, time since last analysis 7 seconds (1269813751-1269813744)]
03/28/10 18:02:31.497950 zmwatch[5794].INF ['zma -m 1' starting at 10/03/28 18:02:31, pid = 32683]

/tmp/zmdc.log:
03/28/10 18:02:35.436485 zmdc[5762].ERR ['zma -m 1' exited abnormally, exit status 40]
03/28/10 18:02:41.618533 zmdc[5762].INF ['zma -m 1' starting at 10/03/28 18:02:41, pid = 32685]

/tmp/zmwatch.log:
03/28/10 18:02:41.498974 zmwatch[5794].INF [Restarting analysis daemon for front_door, time since last analysis 10 seconds (1269813761-1269813751)]
03/28/10 18:02:41.622412 zmwatch[5794].INF ['zma -m 1' starting at 10/03/28 18:02:41, pid = 32685]

/tmp/zmdc.log:
03/28/10 18:02:45.635339 zmdc[5762].ERR ['zma -m 1' exited abnormally, exit status 40]
03/28/10 18:02:51.744595 zmdc[5762].INF ['zma -m 1' starting at 10/03/28 18:02:51, pid = 32689]

/tmp/zmwatch.log:
03/28/10 18:02:51.623438 zmwatch[5794].INF [Restarting analysis daemon for front_door, time since last analysis 10 seconds (1269813771-1269813761)]
03/28/10 18:02:51.748548 zmwatch[5794].INF ['zma -m 1' starting at 10/03/28 18:02:51, pid = 32689]

/tmp/zmdc.log:
03/28/10 18:02:55.643593 zmdc[5762].ERR ['zma -m 1' exited abnormally, exit status 40]
03/28/10 18:03:01.892059 zmdc[5762].INF ['zma -m 1' starting at 10/03/28 18:03:01, pid = 32693]

/tmp/zmwatch.log:
03/28/10 18:03:01.749580 zmwatch[5794].INF [Restarting analysis daemon for front_door, time since last analysis 9 seconds (1269813781-1269813772)]
03/28/10 18:03:01.895979 zmwatch[5794].INF ['zma -m 1' starting at 10/03/28 18:03:01, pid = 32693]