rsyslog

High-performance log ingestion and ETL engine

rsyslog

High-performance log ingestion and ETL engine

rsyslog Windows Agent 8.4a Version History

Windows Agent Release Notes

Release date: 2026-11-04.

Build IDs: Service 8.4.0.241, Client 8.4.0.335.

Bugfixes

  • Updated the included OpenSSL libraries to version 3.5.9.
  • Syslog Listener: Bounded header parsing to prevent malformed messages from interrupting service availability.

Download

The versioned installer is rsyslog Windows Agent 8.4a, 88 MB. SHA-256: 3ca3dbf94b593f9651f11423e33c2a2722105ae5345b2ecfc917ec240748eb4e.

The announcement is the rsyslog Windows Agent 8.4a news release.

rsyslog Windows Agent 8.4a Released

News, news-rwa

Adiscon has released rsyslog Windows Agent 8.4a, a maintenance update for the rsyslog Windows Agent 8.4 line.

This update ships Service 8.4.0.241 and Client 8.4.0.335. It updates the included OpenSSL libraries to version 3.5.9 and includes maintenance for the Syslog Listener.

Changes

  • Updated the included OpenSSL libraries to version 3.5.9.
  • Syslog Listener: Bounded header parsing to prevent malformed messages from interrupting service availability.

Details are in the version history. The versioned installer is rsyslog Windows Agent 8.4a.

rsyslog Windows Agent 26.11 Technical Release Notes

Windows Agent Release Notes

Release date: November 3, 2026
Service build: 26.11.0.357
Configuration Client build: 26.11.0.446
User Interface build: 26.11.0.1020

Upgrade assessment

Recommendation: Recommended update

Why update now: This release adds manual hostname mappings. It also verifies TLS and DTLS destinations, rejects malformed Syslog headers, and corrects remote configuration, licensing, and service diagnostics.

If you defer: Existing processing continues, but hostname mappings and the Syslog, TLS, remote-configuration, and diagnostic corrections in this release remain absent.

Who benefits most: Administrators who map hostnames, receive Syslog, or forward over TLS or DTLS.

Upgrade and verification: Update rsyslog Windows Agent using the normal supported upgrade path. Confirm that the installed service version is 26.11.0.357. Test the changed functions that are relevant to your deployment.

Important changes

Hostname and IP mappings

  • Change: General settings can define hostname and IP address mappings in the Configuration Client and in the User Interface.
  • Operational impact: Events can use a configured hostname or IP address mapping instead of the resolved value alone.
  • Applies to: rsyslog Windows Agent installations that resolve hostnames.
  • Verification: Add a hostname and IP address mapping, then confirm a processed event uses the mapped value.

TLS and DTLS forwarding

  • Change: TLS and DTLS forwarding verify destination certificates and identities. Stalled TLS forwarding no longer blocks shutdown indefinitely.
  • Operational impact: A destination with an unexpected certificate or identity is not treated as verified, and a stalled TLS send does not keep the service from shutting down.
  • Applies to: rsyslog Windows Agent installations that forward over TLS or DTLS.
  • Verification: Exercise one TLS or DTLS forwarding destination you use. Confirm the service shuts down after a TLS send that does not complete promptly.

Syslog Listener

  • Change: The Syslog Listener rejects malformed message headers.
  • Operational impact: A malformed Syslog header is rejected instead of being processed as a normal message.
  • Applies to: rsyslog Windows Agent installations that receive Syslog.
  • Verification: In a test environment, confirm a malformed Syslog header is rejected.

Remote configuration, licensing, and diagnostics

  • Change: Remote configuration rejects invalid HTTPS certificates and insecure redirects. Registry configuration detects the default license file more reliably when the license path is empty and no separate data directory is configured. If a different data directory is configured, that directory remains the default license location. When a listening socket cannot be opened, diagnostics include possible owners.
  • Operational impact: Insecure remote configuration downloads are rejected. The default license file is found for the empty-path registry case described above, and a failed listening socket identifies possible owners.
  • Applies to: rsyslog Windows Agent installations that download remote configuration, use registry licensing, or open listening sockets.
  • Verification: Confirm an invalid HTTPS certificate or an insecure redirect is rejected when downloading configuration. With an empty license path and no separate data directory, confirm the service finds the default license file. Confirm a failed listening socket reports possible owners.

Configuration Client

  • General settings can define hostname and IP address mappings.
  • The Syslog action can set the TLS send progress timeout.
  • A partial configuration is not saved after loading fails, and existing settings are preserved when a selective import fails.

User Interface

  • General settings can define hostname and IP address mappings.
  • The Syslog action can set the TLS send progress timeout.
  • A partial configuration is not saved after loading fails, and existing settings are preserved when a selective import fails.
  • The dashboard displays content in the selected language.

Partner deployment notes

Availability: Use the canonical rsyslog Windows Agent download and this Technical Release Notes page as the release reference; do not use temporary build links as the long-term reference.

Localization: The User Interface translation workflow is being prepared. Translation strings and contribution guidance will be published in the Adiscon community repository when available.

Partner verification: Confirm the installed service, Configuration Client, and User Interface builds. Where relevant, compare a hostname mapping with a processed event and save a configuration change.

Related links

rsyslog Windows Agent 26.11: Monthly Patch + Feature Drop

News, news-rwa

rsyslog Windows Agent 26.11 is the latest monthly Patch + Feature Drop. It adds manual hostname mappings and corrects Syslog Listener handling, TLS forwarding, remote configuration, and service diagnostics.

Map hostnames and IP addresses

General settings can define hostname and IP address mappings. The mappings are available in the Configuration Client and in the User Interface.

Safer forwarding and configuration

The Syslog Listener rejects malformed message headers. TLS and DTLS forwarding verify destination certificates and identities, and stalled TLS forwarding no longer blocks shutdown indefinitely. Remote configuration rejects invalid HTTPS certificates and insecure redirects. Registry configuration detects the default license file more reliably when the license path is empty and no separate data directory is configured. When a listening socket cannot be opened, diagnostics include possible owners. The Configuration Client and the User Interface do not save a partial configuration after loading fails, and they preserve existing settings when a selective import fails. The Syslog action can set the TLS send progress timeout. The User Interface dashboard displays content in the selected language.

The User Interface remains in preview. It is available for production use with appropriate care and review; the Configuration Client remains fully supported.

We recommend keeping rsyslog Windows Agent on the latest Patch + Feature Drop to benefit from current maintenance and product improvements. Your licence remains valid for releases in its calendar year; Upgrade Insurance provides entitlement to later calendar years and their monthly Patch + Feature Drops.

Build information

  • Service: 26.11.0.357
  • Configuration Client: 26.11.0.446
  • User Interface: 26.11.0.1020

Read the Technical Release Notes for rsyslog Windows Agent 26.11 for detailed upgrade guidance, product scope, and verification steps.

rsyslog 8.2610.0 Released

friedlNews, Release Announcement, ,

Scheduled-stable releases are bi-monthly snapshots of the daily-stable branch,
providing predictable update points with the same functional content as
daily-stable at the time of the snapshot.

Highlights

  • Experimental producer-local queue scope for improved queue concurrency
  • New Amazon Kinesis Data Streams output via omkinesis
  • Global strict input startup policy via inputStartupPolicy="require-all"
  • OpenSSL 4 X.509 accessor compatibility
  • Improved asynchronous omfile rotation reliability
  • Queue contention and Elasticsearch request-duration statistics
  • Expanded Enterprise Linux packaging, including an imhttp subpackage
  • Broad defensive hardening across queues, parsers, inputs, TLS, and outputs

Notable changes

Queues, concurrency, and reliability

  • Experimental queue.scope="local" places bounded producer-specific front
    queues ahead of shared FixedArray or LinkedList backends, including disk
    assistance. Global scope remains the default.
  • Queue processing received extensive reliability and performance work,
    including targeted worker wakeups, improved disk-assisted worker restart
    handling, safer shutdown behavior, and reduced shared-lock overhead.
  • Optional queue mutex contention statistics expose contention counts and
    observed wait time through impstats.
  • Existing classic disk queues retain their supported serialization format;
    Darwin ARM64 serialization now uses the expected fixed calling convention.

Inputs and startup policy

  • global(inputStartupPolicy="require-all") can make configured input startup
    failures fatal, including listener and worker failures. The default remains
    best-effort startup.
  • imtcp defers regex framing checks until a line boundary, reducing repeated
    scans for fragmented input.
  • imudp validates receive-buffer dimensions before startup, preventing invalid
    allocation and offset arithmetic.
  • imrelp rejects framing sizes beyond librelp’s supported limit.

Outputs and integrations

  • The new omkinesis action sends signed Kinesis PutRecord requests with
    configurable streams, regions, credentials, payload templates, and fixed or
    template-based partition keys. RainerScript and YAML configurations are
    supported.
  • Asynchronous omfile output now remains active across size-based rotation
    and avoids shutdown hangs and rotation races.
  • mmaitag adds response-size, request-timeout, connect-timeout, and low-speed
    budgets while keeping provider response bodies out of failure diagnostics.
  • omelasticsearch exposes request counts, duration, and interval minimum and
    maximum duration through impstats.
  • The starter PostgreSQL schema accepts longer Docker and journald-style tags.

Normalization, parsing, and TLS

  • mmnormalize preserves complete TurboVM results, including nested JSON and
    null values, and reports truncated results through turbo.truncated.
  • RainerScript replacement and template substring results are bounded safely,
    including negative substring endpoints and large regex-match offsets.
  • Empty compressed records, oversized diagnostics, and raw message offsets are
    validated before use.
  • TLS certificate handling supports newer OpenSSL X.509 accessors while
    retaining compatibility with older OpenSSL versions.
  • DTLS sessions that fail peer verification are closed instead of retained.
    Broken forwarding TLS sessions are explicitly aborted before descriptor reuse.

Overall hardening and security maintenance

This release includes broad defensive hardening across parsers, message
handling, queues, inputs, TLS/DTLS, compression, configuration validation, and
output actions.

It also incorporates security and robustness fixes accumulated in daily-stable
since the previous scheduled-stable release. These include bounds checks,
safer malformed-input handling, stricter certificate and peer validation,
safer dynamic paths, improved queue recovery, and protection against crashes,
resource exhaustion, busy loops, and unsafe shutdown behavior.

Compatibility notes

  • Producer-local queue scope is experimental and opt-in. It requires lock-free
    64-bit atomics and monotonic condition variables; global queue scope remains
    the default.
  • inputStartupPolicy="require-all" is opt-in. Existing configurations retain
    best-effort startup behavior unless the strict policy is enabled.
  • New Kinesis output support requires the corresponding optional build
    dependencies when enabled.

Contributors

Thanks to everyone who contributed to this release, including:

  • Andreas Hasenack
  • F3dor
  • FLAK-ZOSO
  • Galaxy Roaming
  • hanjinpeng
  • Jérémie Jourdin
  • Mattia Marchese
  • owen-rote
  • Peter de Ridder

All other changes were contributed by Adiscon GmbH.

Artifact availability

The rsyslog 8.2610.0 source release is available from the usual rsyslog download locations. Packages and container images may appear with some delay while downstream publishing completes.

rsyslog Windows Agent 26.10 Technical Release Notes

Windows Agent Release Notes

Release date: October 7, 2026
Service build: 26.10.0.354
Configuration Client build: 26.10.0.443
User Interface build: 26.10.0.1018

Upgrade assessment

Recommendation: Recommended update

Why update now: This release updates included OpenSSL libraries to 3.5.9 and corrects configuration editing and service diagnostics in the User Interface.

If you defer: Existing processing continues, but included OpenSSL libraries stay on the previous update, and the configuration-editing and diagnostic corrections in this release remain absent.

Who benefits most: Administrators who use TLS and anyone who edits configuration or follows service diagnostics in the User Interface.

Upgrade and verification: Update rsyslog Windows Agent using the normal supported upgrade path. Confirm that the installed service version is 26.10.0.354. Test the changed functions that are relevant to your deployment.

Important changes

OpenSSL 3.5.9

  • Change: The included OpenSSL libraries are updated to 3.5.9.
  • Operational impact: TLS-using actions and services run with the updated library.
  • Applies to: All rsyslog Windows Agent installations.
  • Verification: After upgrade, confirm the installed service build and exercise one TLS-using function you rely on.

Configuration interface and diagnostics

  • Change: Workbench edits are validated before saving, and the previous document is restored when a save fails. Leaving the page, reloading, switching the configuration source, or restarting asks whether to save or discard unsaved changes. Move rule up moves the selected rule when two rule names differ only by punctuation. Failures from an older remote registry session are ignored, and service commands that would change a remote target are blocked. Empty optional allowed-peer and TLS rows no longer block other edits. Configuration-tree navigation is denser, selection feedback is clearer, and license file path handling is clearer. The empty Advanced page is removed. Debug-log follow stays with appended lines and a replaced log file.
  • Operational impact: Configuration edits are less likely to be lost or applied to the wrong rule, and commands that would change a remote target are blocked.
  • Applies to: rsyslog Windows Agent installations using the User Interface for configuration or service diagnostics.
  • Verification: Save a valid edit and a failing edit, move two rules whose names differ only by punctuation, and follow a debug log while new lines are appended.

User Interface

  • Workbench edits are validated before saving. If a save fails, the previous document is restored.
  • Leaving the page, reloading, switching the configuration source, or restarting asks whether to save or discard unsaved changes.
  • Move rule up moves the selected rule when two rule names differ only by punctuation.
  • Failures from an older remote registry session are ignored, and service commands that would change a remote target are blocked.
  • Empty optional allowed-peer and TLS rows no longer block other edits to the selected service.
  • Configuration-tree navigation is denser, selection feedback is clearer, and license file path handling is clearer.
  • The empty Advanced page is removed.
  • Debug-log follow stays in view when lines are appended or the log file is replaced.

Partner deployment notes

Availability: Use the canonical rsyslog Windows Agent download and this Technical Release Notes page as the release reference; do not use temporary build links as the long-term reference.

Localization: The User Interface translation workflow is being prepared. Translation strings and contribution guidance will be published in the Adiscon community repository when available.

Partner verification: Confirm the installed service, Configuration Client, and User Interface builds. Save a configuration change in the User Interface and, where relevant, exercise one TLS-using function.

Related links

rsyslog Windows Agent 26.10: Monthly Patch + Feature Drop

News, news-rwa

rsyslog Windows Agent 26.10 is the latest monthly Patch + Feature Drop. It updates the included OpenSSL libraries and corrects configuration editing and service diagnostics in the User Interface.

Safer configuration editing

The User Interface validates Workbench edits before saving and restores the previous document if a save fails. Unsaved changes are kept in view when you leave, reload, switch the configuration source, or restart. Rule moves, remote-target protection, configuration-tree navigation, and debug-log follow are corrected, and the empty Advanced page is removed.

Updated OpenSSL

Included OpenSSL libraries are updated to 3.5.9.

The User Interface remains in preview. It is available for production use with appropriate care and review; the Configuration Client remains fully supported.

We recommend keeping rsyslog Windows Agent on the latest Patch + Feature Drop to benefit from current maintenance and product improvements. Your licence remains valid for releases in its calendar year; Upgrade Insurance provides entitlement to later calendar years and their monthly Patch + Feature Drops.

Build information

  • Service: 26.10.0.354
  • Configuration Client: 26.10.0.443
  • User Interface: 26.10.0.1018

Read the Technical Release Notes for rsyslog Windows Agent 26.10 for detailed upgrade guidance, product scope, and verification steps.

libfastjson 1.2609.0 release

friedlNews, Release Announcement, ,

libfastjson 1.2609.0 improves object-member lookup performance, corrects buffered JSON dumping edge cases, and updates build compatibility and quality coverage.

Highlights

  • Speed up object member lookup by traversing child pages directly.
  • Fix buffered JSON dumping with zero-sized and small caller-provided workspaces.
  • Ensure correct linking with libm on glibc 2.42 and later.
  • Correct transposed calloc() arguments that trigger warnings with newer compilers.
  • Clarify string-buffer lifetime and thread-safety guarantees in the API documentation.
  • Expand correctness tests, fuzzing, and cross-platform CI coverage.

Download the Latest Version:

The new version of libfastjson can be downloaded from: libfastjson 1.2609.0 Download

Checksum (sha256sum): 7cd6f78c1c07f4140f6976a9a0e0048bcaa7292329c6ac2c0e070383d83d8edd

rsyslog Windows Agent 26.09 Technical Release Notes

Windows Agent Release Notes

Release date: September 1, 2026
Service build: 26.9.0.353
Configuration Client build: 26.9.0.442
User Interface build: 26.9.0.1017

Upgrade assessment

Recommendation: Recommended update

Why update now: This release corrects service-stop handling during configuration reload, startup of custom-named Windows services, and a timestamp-conversion crash. It also improves administration through the User Interface metrics dashboard.

If you defer: Installations retain the service-operation and timestamp-conversion limitations addressed by this release, as well as the earlier User Interface administration behaviour.

Who benefits most: Administrators who reload configuration, use custom Windows service names, or use the User Interface metrics dashboard.

Upgrade and verification: Update using the normal supported path. Confirm service build 26.9.0.353, reload configuration in a controlled maintenance window, verify a custom service name where used, and reload the User Interface dashboard after Metrics Helper setup.

Important changes

Service operation and reliability

  • Change: Stop requests are retained during configuration reload, and services with custom Windows service names start reliably.
  • Operational impact: Reduces avoidable disruption during service administration and maintenance.
  • Applies to: rsyslog Windows Agent installations that reload configuration or use custom service names.
  • Verification: Reload configuration and, where applicable, stop/start the custom-named service during a controlled maintenance window.

Timestamp conversion reliability

  • Change: A crash while converting certain read-only timestamp properties is corrected.
  • Operational impact: Improves reliability for configurations that process these timestamp properties.
  • Applies to: rsyslog Windows Agent configurations using the affected timestamp conversion path.
  • Verification: Process a representative test message that uses the relevant timestamp property.

Configuration Client and User Interface

  • After local Metrics Helper setup, standard users can reload the User Interface metrics dashboard.
  • Service-owned older General settings no longer produce unnecessary unknown-configuration indications.

Published errata and known issues

Installer-update reliability: ERR-2026-002: rsyslog Windows Agent update reports success but program files are not upgraded correctly is resolved in the 26.09 setup release. After a direct upgrade from an earlier product generation, confirm that the installed service reports 26.9.0.353 and that the Configuration Client and the required features are present.

Related links

Scroll to top