stamparm/maltrail · info

SIGTERM

Error message

SIGTERM

What it means

Maltrail installs a SIGTERM signal handler that logs the literal message "SIGTERM" via log_error and raises SystemExit to shut down cleanly. The "SIGTERM" error entry is therefore a deliberate audit trail: the process received a termination signal (SIGTERM) from outside, not an internal fault.

Solutions

1. If unexpected, find the sender: check `journalctl` for systemd stop/restart, `docker events`, or audit logs for the kill source.
2. Use `kill -TERM` deliberately for graceful shutdown; avoid `kill -9` which bypasses cleanup.
3. If the process should survive logrotate or deploys, configure the service manager to restart it or use reload signals instead.
4. Treat this entry as informational when it coincides with a planned shutdown.

try:
    run_sensor()
except SystemExit:
    log.info('maltrail stopped (SIGTERM)'); flush_state()  # graceful cleanup

When it happens

Trigger: Sending `kill <pid>` (default SIGTERM) to the Maltrail process; systemd/docker stop issuing SIGTERM during service shutdown or restart; orchestrators terminating pods; `pkill maltrail`.

Common situations: Investigating why the sensor stopped and finding this entry — it means someone or something asked it to stop: systemd restart timers, OOM-adjacent cleanup scripts, container lifecycle, or manual ops actions.

Related errors

• [x] invalid IP address
• not a Maltrail provenance sidecar (bad magic)
• provenance sidecar is truncated
• packet too short for header-protection sample
• trail bin too small

AI-assisted analysis of stamparm/maltrail@77cfb06d76 (2026-09-13). Data as JSON: /api/errors/6c6fd6ddd30c2a23. Report an issue: GitHub.

Appendix: source

Thrown at core/log.py:643

        LogUDPServer.address_family = socket.AF_INET6
        _address = resolve_address(address, port)
    else:
        _address = (address or '', int(port) if str(port or "").isdigit() else 0)

    server = LogUDPServer(_address, UDPHandler)

    print("[i] running UDP server at '%s:%d'" % (server.server_address[0], server.server_address[1]))

    if join:
        server.serve_forever()
    else:
        thread = threading.Thread(target=server.serve_forever)
        thread.daemon = True
        thread.start()

def set_sigterm_handler():
    def handler(signum, frame):
        log_error("SIGTERM")
        raise SystemExit

    if hasattr(signal, "SIGTERM"):
        signal.signal(signal.SIGTERM, handler)

if __name__ != "__main__":
    set_sigterm_handler()

View on GitHub (pinned to 77cfb06d76)