有同事按以下命令启动logstash，关闭终端后会随之关闭
root用户
./logstash-6.4.1/bin/logstash -f ./logstash-6.4.1/logstash_test.conf &
在我这里又不会，有点奇怪，研究一下
同样的，启动
./logstash-6.4.1/bin/logstash -f ./logstash-6.4.1/logstash_test.conf &
[1] 69894
看下终端的进程id
who am i
root pts/3 2020-05-29 16:29 (watson-zeng3.we.com)
ps -ef | grep pts/3
root 67215 67210 0 16:29 pts/3 00:00:01 -bash
看下其他信息，sid是会话id
[root@test04 ~]# ps -eo pid,ppid,sid,tty,pgrp,comm | grep -E '69894|67215'
67215 67210 67215 pts/3 67215 bash
69894 67215 67215 pts/3 69894 java #logstash
再开两个终端，用strace调试一下，如果没有这个命令，先安装
yum install strace
窗口1
strace -e trace=signal -p 69894
窗口2
strace -e trace=signal -p 67215
关闭终端
窗口1
[root@test04 ~]# strace -e trace=signal -p 69894
strace: Process 69894 attached
--- SIGHUP {si_signo=SIGHUP, si_code=SI_USER, si_pid=67215, si_uid=0} ---
rt_sigreturn({mask=[]}) = 202
窗口2
[root@test04 ~]# strace -e trace=signal -p 67215
strace: Process 67215 attached
--- SIGHUP {si_signo=SIGHUP, si_code=SI_KERNEL} ---
--- SIGCONT {si_signo=SIGCONT, si_code=SI_KERNEL} ---
kill(-69894, SIGHUP) = 0
rt_sigprocmask(SIG_BLOCK, [CHLD TSTP TTIN TTOU], [HUP INT ILL TRAP ABRT BUS FPE USR1 SEGV USR2 PIPE ALRM TERM XCPU XFSZ VTALRM SYS], 8) = 0
rt_sigprocmask(SIG_SETMASK, [HUP INT ILL TRAP ABRT BUS FPE USR1 SEGV USR2 PIPE ALRM TERM XCPU XFSZ VTALRM SYS], NULL, 8) = 0
rt_sigaction(SIGHUP, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f01c1c27280}, {sa_handler=0x456be0, sa_mask=[HUP INT ILL TRAP ABRT BUS FPE USR1 SEGV USR2 PIPE ALRM TERM XCPU XFSZ VTALRM SYS], sa_flags=SA_RESTORER, sa_restorer=0x7f01c1c27280}, 8) = 0
kill(67215, SIGHUP) = 0
rt_sigreturn({mask=[]}) = -1 EIO (Input/output error)
--- SIGHUP {si_signo=SIGHUP, si_code=SI_USER, si_pid=67215, si_uid=0} ---
+++ killed by SIGHUP +++
[root@test04 ~]#
再看logstash进程，还在！它的父进程变成了1，即被init进程收养了
[root@test04 ~]# ps -ef | grep logstash
root 69894 1 97 17:11 ? 00:04:33 /usr/java/default/bin/java -X
其实我们启动logstash是要先切到elk用户的，
su elk
./logstash-6.4.1/bin/logstash -f ./logstash-6.4.1/logstash_test.conf &
切到elk用户后，再监听logstash进程的变化，发现关闭终端就没有接收到SIGHUP信号
嗯，虽然同事的问题没解决，但还是对信号加深了理解