rsyslog

High-performance log ingestion and ETL engine

rsyslog

High-performance log ingestion and ETL engine

rsyslog 8.2604.0: YAML configuration, Azure Monitor output, and stronger hardening

Rainer GerhardsNews, Release Announcement

We have released rsyslog 8.2604.0, the April 2026 scheduled-stable version. Scheduled-stable releases are bi-monthly snapshots of the daily-stable branch, providing predictable update points with the same functional content as daily-stable at the time of the snapshot.

rsyslog 8.2604.0 release infographic

This release makes rsyslog easier to configure, easier to integrate with modern observability platforms, and more robust under failure conditions.

Four major highlights:

  • YAML as an alternative configuration format
  • Azure Monitor and HTTP ecosystem integration
  • Reliability and security hardening
  • Packaging, CI, and portability improvements

YAML configuration: a new way to configure rsyslog

This release adds YAML as a full alternative configuration format.

You can now use .yaml and .yml files as the main configuration or through include mechanisms, and YAML can coexist with RainerScript. This makes it possible to adopt YAML gradually instead of forcing a full migration.

The YAML work also extends into policy handling:

  • mmjsontransform can now load YAML policies to rename or drop JSON keys before flatten and unflatten processing
  • YAML-backed ratelimit policies can be watched and reloaded automatically, with debounce support
  • Shared ratelimit.name support has been extended across the remaining relevant modules, including imrelp, omusrmsg, omfwd, omelasticsearch, omhttp, imhttp, imjournal, imklog, and imuxsock

This is an important step for users who want more structured, automation-friendly configuration workflows while keeping compatibility with existing RainerScript deployments.

Azure Monitor and HTTP ecosystem integration

This release adds a new Azure Monitor output path via omazuredce.

The new module provides a native way to forward events into Azure-hosted observability workflows. It is complemented by gzip request compression support, which helps reduce payload size for higher-volume forwarding scenarios.

Other integration-related improvements include:

  • route-scoped API key authentication for imhttp
  • native protobuf encoding for omotel via protocol="http/protobuf"
  • improved omhttp connection handling and performance
  • a new omfwd num.connects statistic for TCP connection tracking

These changes continue to expand rsyslog’s role as a log ingestion and ETL engine that integrates cleanly with modern cloud and telemetry backends.

Reliability and security hardening

A large part of 8.2604.0 is focused on hardening across the runtime.

Highlights include:

  • queue hardening, including follow-up fixes for corrupt disk queue recovery and a startup segfault
  • a fix for a rare imjournal condition that could lead to a 100% CPU loop
  • stronger imtcp validation and worker shutdown handling
  • bounded per-PID ratelimiter cache handling in imuxsock
  • safer payload length handling in omhttp
  • better handling of TCP batch processing when messages are dropped by ratelimiting
  • stable callback-state handling in omrelp
  • an omkafka poll thread to avoid delayed statistics polling and related race conditions
  • systemd watchdog keepalive pings while rsyslog is running

TLS-related improvements also continue:

  • GnuTLS CRL expiration is now checked correctly, so expired CRLs no longer get silently accepted
  • native post-quantum TLS guidance and tests were added for supported platforms
  • DTLS builds now explicitly require OpenSSL support when imdtls or omdtls is enabled

Additional improvements

This release also includes substantial work around packaging, testing, and portability:

  • RPM packaging overhaul and CI integration
  • Rocky Linux 9 / EPEL 9 alignment for RPM CI
  • Alpine compile checks and musl resolver support for omfwd
  • ARM CI improvements, including imfile coverage
  • initial deterministic unit test plumbing for faster local verification
  • deterministic project policy checks in CI
  • removal of shipped .gitignore files from distribution tarballs
  • continued documentation and doc-build stabilization work

Compatibility notes

  • For full 8.2604.0 functionality, builds should include libyaml. Building without libyaml is still possible, but many important new capabilities are unavailable.
  • YAML configuration support is available starting with rsyslog 8.2604.0.
  • DTLS modules now require OpenSSL support to be explicitly enabled at build time.

Thank you

We thank all contributors who made this release possible.

  • Aditi Prakash
  • anargam
  • Attila Lakatos
  • ca.mathieu
  • Jan Kängsepp
  • Marsel Mavletkulov
  • Sagar Singh
  • shinigami35

All other changes were contributed by Adiscon GmbH.

Scroll to top