启动logstash，关闭终端后会随之关闭

有同事按以下命令启动logstash，关闭终端后会随之关闭

root用户
./logstash-6.4.1/bin/logstash -f ./logstash-6.4.1/logstash_test.conf &

在我这里又不会，有点奇怪，研究一下

同样的，启动

./logstash-6.4.1/bin/logstash -f ./logstash-6.4.1/logstash_test.conf &

[1] 69894

看下终端的进程id

who am i 
    root     pts/3        2020-05-29 16:29 (watson-zeng3.we.com)

ps -ef | grep pts/3

    root      67215  67210  0 16:29 pts/3    00:00:01 -bash

看下其他信息，sid是会话id

[root@test04 ~]# ps -eo pid,ppid,sid,tty,pgrp,comm | grep -E '69894|67215'
 67215  67210  67215 pts/3     67215 bash
 69894  67215  67215 pts/3     69894 java #logstash

再开两个终端，用strace调试一下，如果没有这个命令，先安装

yum install strace

窗口1

strace -e trace=signal -p 69894

窗口2

strace -e trace=signal -p 67215

关闭终端

窗口1

[root@test04 ~]# strace -e trace=signal -p 69894
strace: Process 69894 attached
--- SIGHUP {si_signo=SIGHUP, si_code=SI_USER, si_pid=67215, si_uid=0} ---
rt_sigreturn({mask=[]})                 = 202

窗口2

[root@test04 ~]# strace -e trace=signal -p 67215
strace: Process 67215 attached
--- SIGHUP {si_signo=SIGHUP, si_code=SI_KERNEL} ---
--- SIGCONT {si_signo=SIGCONT, si_code=SI_KERNEL} ---
kill(-69894, SIGHUP)                    = 0
rt_sigprocmask(SIG_BLOCK, [CHLD TSTP TTIN TTOU], [HUP INT ILL TRAP ABRT BUS FPE USR1 SEGV USR2 PIPE ALRM TERM XCPU XFSZ VTALRM SYS], 8) = 0
rt_sigprocmask(SIG_SETMASK, [HUP INT ILL TRAP ABRT BUS FPE USR1 SEGV USR2 PIPE ALRM TERM XCPU XFSZ VTALRM SYS], NULL, 8) = 0
rt_sigaction(SIGHUP, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f01c1c27280}, {sa_handler=0x456be0, sa_mask=[HUP INT ILL TRAP ABRT BUS FPE USR1 SEGV USR2 PIPE ALRM TERM XCPU XFSZ VTALRM SYS], sa_flags=SA_RESTORER, sa_restorer=0x7f01c1c27280}, 8) = 0
kill(67215, SIGHUP)                     = 0
rt_sigreturn({mask=[]})                 = -1 EIO (Input/output error)
--- SIGHUP {si_signo=SIGHUP, si_code=SI_USER, si_pid=67215, si_uid=0} ---
+++ killed by SIGHUP +++
[root@test04 ~]# 

再看logstash进程，还在！它的父进程变成了1，即被init进程收养了

[root@test04 ~]# ps -ef | grep logstash
root      69894      1 97 17:11 ?        00:04:33 /usr/java/default/bin/java -X

其实我们启动logstash是要先切到elk用户的，

su elk
./logstash-6.4.1/bin/logstash -f ./logstash-6.4.1/logstash_test.conf &

切到elk用户后，再监听logstash进程的变化，发现关闭终端就没有接收到SIGHUP信号

嗯，虽然同事的问题没解决，但还是对信号加深了理解