Fri, 16 May 2008 16:42:48 +0200 http://www.rsyslog.com/ rsyslog en-us http://www.rsyslog.com/images/logo.gif http://www.rsyslog.com/ InternetAdmins@adiscon.com http://www.rsyslog.com/Article229.phtml Hi all, rsyslog 3.19.2, a development branch version, has just been released. This version contains a new property "fromhost-ip", which enables to obtain the IP address of the syslog sender irrelevant of the -x option setting. So now both the name and IP address are available. Other than that, the version contains a number of bug fixes, many in the TLS area. This version is a recommended update for all development branch users. It is quite stable. It is not yet suggested to use the TLS functionality outside of test environments. Changelog: http://www.rsyslog.com/Article228.phtml Download: http://www.rsyslog.com/Downloads-req-viewdownloaddetails-lid-105.phtml As always, feedback is appreciated, Florian Riedl Fri, 16 May 2008 16:42:48 +0200 http://www.rsyslog.com/Article227.phtml Hi all, I have just released rsyslog 2.0.5, an update for the v2-stable branch. This is primarily a bug fixing release. It solves a problem with regular expression based field-extraction and provides better compatibility with recent versions of liblogging. This update is recommended, but not absolutely necessary if you do not experience any problems with your current v2-stable install. Changelog: http://www.rsyslog.com/Article226.phtml Download: http://www.rsyslog.com/Downloads-req-viewdownloaddetails-lid-104.phtml I hope this release is useful. As always, feedback is appreciated. Rainer Fri, 16 May 2008 10:47:13 +0200 http://www.rsyslog.com/Article225.phtml Hi all, the rsyslog forum is being consolidated into one big, useful troubleshooting resource. There are a number of good reasons for this and I named them all in my blog. Please read there, if you look for the specifics. Due to the change, the forums are offline for a short period of time. Also, it most probably is necessary to re-register forum users. I am sorry for this inconvenience, but I think it is worth it if you think about the benefits in the long term. In the mean time: sorry for the hassle... Rainer Tue, 13 May 2008 10:43:37 +0200 http://www.rsyslog.com/Article224.phtml We have just released rsyslog 3.19.1, an update of the development branch. This version primarily fixes some problems with the build system. There were some files missing, which could result in strange warnings. Also, some minor code cleanup to get rid of some compiler warnings is included. This version is highly recommended for all users of the development branch. Note, however, that it is still not suitable for use on production machines. Changelog: http://www.rsyslog.com/Article223.phtml Download: http://www.rsyslog.com/Downloads-req-viewdownloaddetails-lid-103.phtml As always, feedback is appreciated. Rainer Wed, 07 May 2008 19:52:04 +0200 http://www.rsyslog.com/Article222.phtml I am very pleased to announce rsyslog 3.19.0. It is the first release that natively supports TLS for plain TCP syslog. Actually, it is the world's first implementation of the upcoming syslog-transport-tls IETF standard. As this standard is not yet finished, the implementation is obviously experimental. Native TLS is a big improvement over existing functionality. For example, rsyslog can now be used without the help of stunnel, which relieves us of some problems from those configurations. To the best of my knowledge, rsyslog is the first open-source syslogd offering TLS support natively. The current TLS functionality is limited to the bare minimum. During the next few weeks, I will improve it based on my own spec and feedback (hopefully received). My hope is to have a production-grade implementation by summer at latest. Please note rsyslog's premium and ultra-reliable RELP protocol does not yet support TLS (but can be used with stunnel without the real problems legacy tcp had with it). My plan is to let TLS mature with legacy syslog and then move it to RELP. Thus I can limit my development to one major use case, which I think will facilitate things. There is some documentation on how to use the new TLS mode: http://www.rsyslog.com/doc-rsyslog_tls.html Currently, TLS is provided via GnuTLS. As I outlined earlier on the list, GnuTLS offered much more support to getting started (documentation and sample-code wise). I will focus on GnuTLS until I am fully satisfied with the TLS implementation). I'll then see that I can also integrate NSS. Advise in this regard would be highly welcome, so if you have some knowledge in this area, please contribute. In order to support TLS (and multiple libraries!), a major rewrite of the networking components has been done. Rsyslog now supports a so-called "network streams" (netstreams) driver interface. This interface enables app-level functionality (like the legacy tcp syslog sender and receiver) to work with dynamically selectable netstream drivers (like plain (unencrypted) TCP) and TLS). This interface will enable rsyslog to utilize other TLS drivers (and even other protocols) in the future. Different drivers can even be used concurrently. Rsyslog now has been split into a runtime system and tools (with currently rsyslogd being the only tool). This design will further strengthen modularization and help make rsyslog functionality available in small parts. Finally, the RFC 3195 input has been rewritten in the form of an input plugin. It can now be build as part of the normal build procedure. Please note that there were a couple of major changes. I expect the initial 3.19.0 to be quite Unstable. I recommend it for testing environments, only. Even those parts that were not directly touched may have become a bit destabilized due to the runtime split. So please use it with care. Feedback, however, would be more than welcome, because I need to start somewhere to stabilize this release. That can only be done with your help. So please use it on test systems, try to break it and file bug reports when it fails. Download: http://www.rsyslog.com/Downloads-req-viewdownloaddetails-lid-102.phtml Changelog: http://www.rsyslog.com/Article221.phtml File your bug reports here ;) : http://bugzilla.adiscon.com/rsyslog-bugs.html I hope this release is useful. Feedback is much appreciated. Tue, 06 May 2008 12:05:19 +0200 http://www.rsyslog.com/Article219.phtml Hi all, We have just released rsyslog 3.16.1, a release of the v3-stable branch. This version contains one important bug fix. The imklog input plugin did not correctly start up in some environments and could even cause a segfault. This is now corrected. Upgrading to 3.16.1 is strongly recommended for all users of the v3-stable branch who use imklog. Download: http://www.rsyslog.com/Downloads-req-viewdownloaddetails-lid-100.phtml Changelog: http://www.rsyslog.com/Article218.phtml Florian Riedl Fri, 02 May 2008 16:14:32 +0200 http://www.rsyslog.com/Article217.phtml Hi all, Version 2.1.0 is the first beta version of the v2 branch. PhpLogCon has been completely rewritten from scratch. It now offers a state-of-the art modern user interface and also is able to work with log files and not just databases. For example, it can be used to view a remote server's log files over the web (proper authentication settings highly recommended). Download: http://www.phplogcon.org/Downloads-req-viewdownloaddetails-lid-7.phtml Feedback is very appreciated. Florian Riedl Thu, 24 Apr 2008 17:28:59 +0200 http://www.rsyslog.com/Article216.phtml Hi all, I have just released rsyslog 3.16.0, a v3-stable release. This release brings a major new feature, RELP support, to the stable branch. RELP enables lossless transmission of syslog messages, in cases where even plain tcp syslog fails. Other than that, the release contains a few bugfixes. Users of the v3-stable branch are advised to update to the new release. Download: http://www.rsyslog.com/Downloads-req-viewdownloaddetails-lid-99.phtml Changelog: http://www.rsyslog.com/Article215.phtml Florian Riedl Thu, 24 Apr 2008 14:30:30 +0200 http://www.rsyslog.com/Article214.phtml Hi all: Rsyslog 3.17.1 has just been released. The primary new feature is full BSD platform support. Rsyslog now not only compiles cleanly on BSD, but also now supports BSD's kernel log natively. In general, kernel logging has been improved and better documented. High-precision timestamps for the kernel log have been enabled. There are also some minor other enhancements as well as a couple of bug fixes. Rsyslog 3.17.1 is a recommended update for all users of the devel branch. Changelog: http://www.rsyslog.com/Article213.phtml Download: http://www.rsyslog.com/Downloads-req-viewdownloaddetails-lid-98.phtml As always, feedback is appreciated. Rainer Tue, 15 Apr 2008 15:25:00 +0200 http://www.rsyslog.com/Article212.phtml Hi all, I have just released 3.14.2, an update to v3-stable. It is a purely bug-fixing release. Most importantly, it fixes a problem that caused imklog not to pull module symbols correctly from recent kernels. Also, a segfault caused by using expression-based filters is fixed. There are also some other fixes, see ChangeLog for details. This is a recommended update for all v3-stable branch users. Changelog: http://www.rsyslog.com/Article209.phtml Download (now pointing to the info page so that you see the md5sum ;)): http://www.rsyslog.com/Downloads-req-viewdownloaddetails-lid-96.phtml I hope this release is useful. As always, feedback is appreciated. Rainer Fri, 11 Apr 2008 11:53:26 +0200 http://www.rsyslog.com/Article211.phtml Hi all, rsyslog 3.15.1 has been released. This is a refresh of the beta branch, providing new bug fixes. The beta branch currently features the RELP protocol and will be the next v3-stable once it has sufficiently matured. Changelog: http://www.rsyslog.com/Article210.phtml Download: http://www.rsyslog.com/Downloads-req-viewdownloaddetails-lid-97.phtml As always, feedback is appreaciated. Florian Riedl Fri, 11 Apr 2008 11:23:15 +0200 http://www.rsyslog.com/Article208.phtml Hi all, rsyslog 3.17.0 has just been released. It is part of the development branch. The primary new feature is the ability to send email alerts based on syslog or file data. The action engine now has the ability to carry out an action only once within a configured interval and/or only during specific time frames. Option processing has been improved and a number of stability updates have been included. This is a recommended update for all users of the development version. More information on the major new feature can be found here: http://www.rsyslog.com/doc-ommail.html The following is a sample code snippet that alerts the operator when disk problems are detected: $ModLoad ommail $ActionMailSMTPServer mail.example.net $ActionMailFrom rsyslog@example.net $ActionMailTo operator@example.net $template mailSubject,"disk problem on %hostname%" $template mailBody,"RSYSLOG Alert\r\nmsg='%msg%'" $ActionMailSubject mailSubject # make sure we receive a mail only once in six # hours (21,600 seconds ;)) $ActionExecOnlyOnceEveryInterval 21600 # the if ... then ... mailBody mus be on one line! if $msg contains 'hard disk fatal failure' then :ommail:;mailBody Note that we now have the ability to limit an action to be executed only once inside a specific period. In the above sample, the email alert happens only if there was no other such alert within the past 6 hours - this is absolutely vital to prevent an accidental DoS on your mailbox ;) ... but it may also be handy with other actions (e.g. SNMP trap notification etc etc). It's implemented at the action engine level, so it will work with any action, even file or database writes. Change Log: http://www.rsyslog.com/Article207.phtml Download: http://www.rsyslog.com/Downloads-req-getit-lid-95.phtml I would be most interested in feedback on the new email feature, including clever use cases. I am sure it can be quite useful (especially if you think about imfile...), but would really appreciate to hear from you (and prove this in practice)! Thanks, Rainer Gerhards Wed, 09 Apr 2008 17:19:13 +0200 http://www.rsyslog.com/Article206.phtml Hi all, I am glad to finally announce rsyslog 3.14.1, the first version of the v3 stable branch. This version offers almost all features of the current development version to those in need of a stable branch. Among others, this includes support for multiple database backends, queued and offline operations, SNMP and text file support. It is a big step compared to the v2 stable branch. Users are advised to check the compatibility notes before the update. It's not strictly necessary, but will enable to use rsyslog in the most efficient and problem-free way. Please note that development continues inside the v3 branch. The v3 stable branch will see future feature enhancements after they have sufficiently matured. The v2 stable branch is still supported. It is quite featureless (compared to v3) but extremely solid. So if you are (or need to be) ultra-conservative, you can still take the v2 route. Feature-wise v2 is a dead end and only bug fixes will be provided. The general recommendation is that the v3 stable branch be used for regular production machines. The Fedora project will feature rsyslog v3 stable in its upcoming release 9. Please note that I made a mistake two days ago: I accidently released 3.14.0 to the web, without it being actually ready. For this reason, I have renamed the release to 3.14.1. There will never be an official 3.14.0 release. If you happen to have it downloaded and installed, please accept my apologies. You should get 3.14.1 whenever you are ready. Change Log: http://www.rsyslog.com/Article205.phtml Download: http://www.rsyslog.com/Downloads-req-getit-lid-94.phtml I hope this release is useful. As always, feedback is appreciated. Best regards, Rainer Gerhards Fri, 04 Apr 2008 17:19:46 +0200 http://www.rsyslog.com/Article204.phtml Hi all, yes, I know it's April, 1st. But this release is not related to it ;) I have just released rsyslog 3.15.0, the release that finally provides initial RELP support. RELP provides superior reliability over plain tcp syslog, ensuring that no messages are lost. With plain TCP, this can happen if the remote server goes down. RELP protects from this by utilizing a full-duplex protocol where each message is acknowledged. RELP should also be safe to use with stunnel, where plain tcp syslog sometimes gets into trouble. The core RELP protocol support is NOT part of rsyslog. It comes in the form of librelp, available at http://www.librelp.com . You need to install librelp before you try to compile rsyslog with RELP support. That should be fairly simple. If you run into any troubles, please let me know - I am more than happy to help. I plan to do some more in-depth doc on the use cases soon. Change Log: http://www.rsyslog.com/Article203.phtml Download: http://www.rsyslog.com/Downloads-req-getit-lid-93.phtml I hope this release is useful. Feedback is appreciated. Rainer Tue, 01 Apr 2008 19:02:52 +0200 http://www.rsyslog.com/Article202.phtml Hi all, I have just release rsyslog 3.13.0-dev0, which will hopefully become the next stable release by mid-week. It fixes two bugs, one is a potential segfault in the syslog/plain tcp receiver. The other one is removal of some debug instrumentation that accidently made it into 3.12.5. There is also a new ./configure option (--enable/disable-rsyslogd) which permits to build just specific plugins without the main binary. This has been added to support source-based packaging systems (like in FreeBSD). This is also a test for one potential new versioning scheme. 3.13.0-dev0 is recommended for all v3 branch users. Feedback on it is highly appreciated. Changelog: http://www.rsyslog.com/Article201.phtml Download: http://www.rsyslog.com/Downloads-req-getit-lid-92.phtml Florian Riedl Mon, 31 Mar 2008 17:07:52 +0200 http://www.rsyslog.com/Article200.phtml Hi All, rsyslog 3.12.5 has just been released. It is mostly a bug-fixing and cleanup release. Some changed defaults make it easier to use advanced features. For example, high-precision timestamps are now enabled by default when writing log files and "last message repeated n times" processing, a typical trouble spot, is turned off by default. The documentation has been improved and the v2-backward compatibility layer has been completed. This version is a candidate to become the next stable release. Changelog: http://www.rsyslog.com/Article199.phtml Download: http://www.rsyslog.com/Downloads-req-getit-lid-91.phtml I suggest to (re-) read ./doc/v3compatibility.html, which also talks about the new defaults. Also available online at: http://www.rsyslog.com/doc-v3compatibility.html Feedback on this release is appreciated. I hope it will be useful. Rainer Fri, 28 Mar 2008 18:45:33 +0100 http://www.rsyslog.com/Article198.phtml Hi all, rsyslog 2.0.4, a stable release version, has been released today. It contains some bug fixes, the most important one is that FROMHOST was not properly set on internal messages. There are also two new properties ($HHOUR and $QHOUR) which can be used in dynamic log file generation. Rsyslog 2.0.4 is a recommended update for all users of the stable v2 branch. Changelog: http://www.rsyslog.com/Article197.phtml Download: http://www.rsyslog.com/Downloads-req-getit-lid-90.phtml Florian Riedl Thu, 27 Mar 2008 17:32:13 +0100 http://www.rsyslog.com/Article197.phtml Version 2.0.4 STABLE (rgerhards), 2008-03-27 bugfix: internally generated messages had "FROMHOST" property not set bugfix: continue parsing if tag is oversize (discard oversize part) - thanks to mclaughlin77@gmail.com for the patch added $HHOUR and $QHOUR system properties - can be used for half- and quarter-hour logfile rotation Thu, 27 Mar 2008 16:51:38 +0100 http://www.rsyslog.com/Article196.phtml Hi all, rsyslog 3.12.4 has been released today. Thanks to a changed default, it now offers much faster log file writing. Also, advanced flow control has now been added to all inputs, giving an even more reliable system. There are some other small enhancements (see change log). There are also a number of bug fixes, the most important one being a fix for a massive memory leak in imklog. It lost several hundred kilobytes on each hup. Rsyslog 3.12.4 is a recommended update for all v3 branch users. Download: http://www.rsyslog.com/Downloads-req-getit-lid-89.phtml Changelog: http://www.rsyslog.com/Article195.phtml As always, feedback is appreciated. Florian Riedl Tue, 25 Mar 2008 11:25:50 +0100 http://www.rsyslog.com/Article194.phtml Hi all, rsyslog 3.12.3 has been released today. It is primarily a bug-fixing release, but offers new, advanced flow control options. So far, only imfile utilizes these, but other modules will do so soon. The release contains important bug fixes, for example for a segfault on hup, improper framing for syslog/tcp communication and processing empty lines in the log file reader. Rsyslog 3.12.3 is a recommended update to all v3 branch users and users of 3.12.2 are urged to apply the update (some bugs where introduced in that release). Download: http://www.rsyslog.com/Downloads-req-getit-lid-88.phtml Changelog: http://www.rsyslog.com/Article193.phtml As always, feedback is appreciated. Florian Riedl Tue, 18 Mar 2008 15:04:21 +0100 http://www.rsyslog.com/Article192.phtml Hi all, the development branch also sees a new released. Rsyslog 3.12.2 is available immediately. It is primarily a code cleanup and bug fixing release. Feature-wise, it aims at some better recovery of aborted TCP sessions. It contains a number of important fixes, which, for example, prevent a segfault when imfile tries to read empty log file lines. Internally, loadable library modules are now automatically unloaded if they are no longer used. Rsyslog 3.12.2 is a recommended update for all v3 branch users. Download: http://www.rsyslog.com/Downloads-req-getit-lid-87.phtml Changelog: http://www.rsyslog.com/Article191.phtml Feedback is, as always, appreciated. Thank you. Florian Riedl Thu, 13 Mar 2008 12:59:11 +0100 http://www.rsyslog.com/Article190.phtml Rsyslog 2.0.3, a release of the stable branch, has been released today. It is a purely bug-fixing release, solving mostly bugs that occur either seldom or due to mistakes in the configuration file. It fixes some potential segfaults in those cases. Rsyslog 2.0.3 is a recommended update for all users of the rsyslog v2 branch. Download: http://www.rsyslog.com/Downloads-req-getit-lid-86.phtml Changelog: http://www.rsyslog.com/Article189.phtml As always, feedback is appreciated. Rainer Gerhards Wed, 12 Mar 2008 18:51:35 +0100 http://www.rsyslog.com/Article188.phtml Hi all, Rsyslog 3.12.1 is available immediately. There has been a log going on under the hood, code has been cleaned up and become more modular (you'll see more of that in the upcoming releases) and a library plugin-interface has been added (which so far is not really visible to the end user). We also worked a bit on portability and rsyslogd now compiles under HP UX. We are looking for testers, so if you have HP UX, you are invited to try it out. Feature-wise, a new syslog mib as been added, runtime debugging support enhanced and the ability to discard timestamps received via unix sockets has now been added (and is the default). This is necessary to keep time information consistent even if local programs log with wrong time information (what they do in practice). The gssapi code has greatly been changed and uses the new dynamic plugin library system. Consequently, some trouble in this regard cannot be ruled out ;). Finally, there is an important bugfix: failed actions were not properly retried, causing message loss in a destination-failure scenario. This is now corrected. Download: http://www.rsyslog.com/Downloads-req-getit-lid-85.phtml Change Log: http://www.rsyslog.com/Article187.phtml As always, feedback is appreciated. Rainer Gerhards Thu, 06 Mar 2008 15:42:44 +0100 http://www.rsyslog.com/Article186.phtml Hi all, as promised, I have just released rsyslog 3.12.0. It has one new major feature, and that is complex expression support inside filters. For example, you can now do the following [all of this is on *one* line]: if $syslogfacility-text == 'local0' and $msg startswith 'DEVNAME' and ($msg contains 'error1' or $msg contains 'error0') then /var/log/somelog There is no restriction on the complexity of expressions. As with selector lines, you can specify as many "if"-filters as you like. I personally have been waiting very long for this feature, as I consider it core functionality which should be provided. So I am more than happy that we now have it. Please note that I will continue to enhance this facility, ultimately ending up with a simple configuration script language. During that course, some syntax may change, so you may need to slightly modify your configuration files if you upgrade to a later release. Documentation for this feature can be found under "Expression-based Filters" on the rsyslog.conf page: http://www.rsyslog.com/doc-rsyslog_conf.html No other changes or fixes are included in 3.12.0. Changelog: http://www.rsyslog.com/Article185.phtml Download: http://www.rsyslog.com/Downloads-req-getit-lid-84.phtml I hope the new feature is useful. Feedback is appreciated. Rainer Thu, 28 Feb 2008 12:43:04 +0100 http://www.rsyslog.com/Article184.phtml Hi all, rsyslog 3.11.6 has been released today. It is a bug-fixing release. It fixes a number of bugs related to queue engine termination, each of which could cause a segfault (but only during shutdown or HUP, see change log for details). It also fixes a problem with compatibility mode. Finally, it fixes the bug that caused 3.11.5 core to still link against GSSAPI libraries. Version 3.11.6 is a recommended update for all v3 branch users. Please note, however, that I will most probably release 3.12.0 either tomorrow or Friday, so if you do not experience any problems, you may want to wait for this. Changelog: http://www.rsyslog.com/Article183.phtml Download: http://www.rsyslog.com/Downloads-req-getit-lid-83.phtml I hope this release is useful. Best regards, Rainer Gerhards Thu, 28 Feb 2008 10:40:08 +0100