Analyzers that exit clean without reading input until EOF

[philrz]

@nwt's comment from brimdata/zui#2926 (comment):

What's happening here is that Suricata is exiting cleanly (i.e., with status 0) without reading its standard input to EOF. When Suricata exits, io.Copy in the goroutine created by analyzer.runProcesses returns because writes to the pipe connected to its standard input start failing. The goroutine then closes Zeek's standard input, resulting in this error.

That Zui issue improved how Brimcap catches and presents this kind of error, but @nwt feels there's still improvements that can be made on the Brimcap side. A current quote:

Right now brimcap assumes that analyzers that exit with status zero will read their standard input until EOF. I’m not sure that’s a good assumption.

[philrz]

Note to self: I think when this one is fixed, the user's pcap referenced in brimdata/zui#2926 (comment) should be able to load successfully in Zui. Suricata will still decline to analyze it (but exit with code 0) because of this open Suricata issue, but it sounds like an inaccurate Zeek failure will no longer be surfaced, which seems like an improvement to me.

[philrz]

In fact, the same goes for the pcap referenced in brimdata/zui#2926 (comment). I'm late in fully recognizing this, but that one's similarly mis-reported as a Zeek failure at the moment but due to a different open Suricata issue. Zeek still doesn't do anything interesting with this traffic (it generates a couple weird and notice events that express its inability to handle 802.11) but it seems to finish processing and exits cleanly.

[philrz]

Verified in Brimcap commit 070d2a0.

In the attached video I'm testing it out by using Zui commit 92dcd10 pointed at Brimcap commit 070d2a0 to have the benefit of this fix. Loading the VanSpy.pcapng test file from brimdata/zui#2926 (comment), this now loads without popping up an error. I also successfully loaded the pcap mentioned in brimdata/zui#2926 (comment) but since that user's data was sensitive it's not shown in the video.

Verify.mp4

Thanks @mattnibs!