The rocket-fast system for log processing

ChangeLog for 5.1.3 (devel)

Version 5.1.3 [DEVEL] (rgerhards), 2009-07-28

  • architecture change: queue now always has at least one worker thread if not running in direct mode. Previous versions could run without any active workers. This simplifies the code at a very small expense. See v5 compatibility note document for more in-depth discussion.
  • enhance: UDP spoofing supported via new output module omudpspoof. See the omudpspoof documentation for details and samples
  • bugfix: message could be truncated after TAG, often when forwarding. This was a result of an internal processing error if maximum field sizes had been specified in the property replacer.
  • bugfix: minor static memory leak while reading configuration did NOT leak based on message volume
  • internal: added ability to terminate input modules not via pthread_cancel but an alternate approach via pthread_kill. This is somewhat safer as we do not need to think about the cancel-safeness of all libraries we use. However, not all inputs can easily supported, so this now is a feature that can be requested by the input module (the most important ones request it).