Handling feed detection

During the init method the parser try to determine the feed type detection type [0]:

If the self.feedname isn't set, then the mode is detect [1]:

Later, during processing a report, the feed name is detected and eventually set [2]:

Reloading bot

Then, during the reload (not restart) happens, the bot is re-initialized without creating a new object:

This mechanism is used during log rotation by our standard Debian configuration:

and of course re-load the configuration, refreshing all parameters set in the config file [3]:

Failing edge case

Requirements

• Assuming you want parser to detect the feed, so you didn't set any value in parametrs.feedname in the parser config.
• You have also installed our Debian package or manually configured log rotation with reloading.
• Your IntelMQ instance is working long enough for log rotation to occur.

Case steps

1. After starting bot, the mode is correctly detect [1], and then handling every report a correct feed is detected and set [2].
2. The log rotation occurs, and the parser is reloaded.
3. The configuration is refreshed, overriding all fields set in the config file [3].
4. Bot init method is called once more and tries to detect mode, but self.feedname is still set with the last value before reload, and the fixed mode is detected [0].
5. On every next report handled, the last previously detected feed is used

Workarounds

Set the feedname as null in the config. However, due to the IntelMQ Manager issue with nulls certtools/intelmq-manager#294 this may be changed to an empty string and case the fail again.

Fixes

• The quickest - clean the feedname in bot's shutdown method. If the config has a value, it will be set.

However, this issue can happen to any bot relying on default values and modifying their config. Probably it should be later solved on the IntelMQ library level.