rsyslog

High-performance log ingestion and ETL engine

rsyslog

High-performance log ingestion and ETL engine

Author : adisconteam

Changelog for 5.9.0 (v5-devel)

adisconteamChangelog, , , ,

Version 5.9.0 [V5-DEVEL] (rgerhards), 2011-06-08

  • imfile: added $InputFileMaxLinesAtOnce directive
  • enhanced imfile to support input batching
  • added capability for imtcp and imptcp to activate keep-alive packets
    at the socket layer. This has not been added to imttcp, as the latter is
    only an experimental module, and one which did not prove to be useful.
    reference: http://kb.monitorware.com/post20791.html

  • added support to control KEEPALIVE settings in imptcp
    this has not yet been added to imtcp, but could be done on request.

  • $ActionName is now also used for naming of queues in impstats
    as well as in the debug output

  • bugfix: do not open files with full privileges, if privs will be dropped
    This make the privilege drop code more bulletproof, but breaks Ubuntu’s
    work-around for log files created by external programs with the wrong
    user and/or group. Note that it was long said that this “functionality”
    would break once we go for serious privilege drop code, so hopefully
    nobody still depends on it (and, if so, they lost…).

  • bugfix: pipes not opened in full priv mode when privs are to be dropped
  • this begins a new devel branch for v5
  • better handling of queue i/o errors in disk queues. This is kind of a
    bugfix, but a very intrusive one, this it goes into the devel version
    first. Right now, “file not found” is handled and leads to the new
    emergency mode, in which disk action is stopped and the queue run
    in direct mode. An error message is emited if this happens.

  • added support for user-level PRI provided via systemd
  • added new config directive $InputTCPFlowControl to select if tcp
    received messages shall be flagged as light delayable or not.

  • enhanced omhdfs to support batching mode. This permits to increase
    performance, as we now call the HDFS API with much larger message
    sizes and far more infrequently

  • bugfix: failover did not work correctly if repeated msg reduction was on
    affected directive was: $ActionExecOnlyWhenPreviousIsSuspended on
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=236

rsyslog 6.1.8 (beta) released

adisconteamNews, Release Announcement, , ,

This release begins the first beta branch for the v6 branch of rsyslog.

Note that the 6.1.7 version, released roughly a month ago was not functionally enhanced since then. We already begun a new branch that will become 6.3.0. So technically, 6.1.7 can be considered beta as well.

As such, we expect a quicker than usual beta cycle for version 6.1.

This release imports some bug fixes done to older versions as well as some minor enhancements (not affecting stability). An update to this version is useful for users of the 6.1 versions, but if you experience no problems, it the update is not urgent.

ChangeLog:

http://www.rsyslog.com/changelog-for-6-1-8-beta/

Download:

http://www.rsyslog.com/rsyslog-6-1-8-beta/

As always, feedback is appreciated.

Best regards,
Tom Bergfeld

Changelog for 5.8.1 (v5-stable)

adisconteamChangelog, , , ,

Version 5.8.1 [V5-stable] (rgerhards), 2011-05-19

  • bugfix: invalid processing in QUEUE_FULL condition
    If the the multi-submit interface was used and a QUEUE_FULL condition
    occured, the failed message was properly destructed. However, the
    rest of the input batch, if it existed, was not processed. So this
    lead to potential loss of messages and a memory leak. The potential
    loss of messages was IMHO minor, because they would have been dropped
    in most cases due to the queue remaining full, but very few lucky ones
    from the batch may have made it. Anyhow, this has now been changed so
    that the rest of the batch is properly tried to be enqueued and, if
    not possible, destructed.

  • new module mmsnmptrapd, a sample message modification module
    This can be useful to reformat snmptrapd messages and also serves as
    a sample for how to write message modification modules using the
    output module interface. Note that we introduced this new
    functionality directly into the stable release, as it does not
    modify the core and as such cannot have any side-effects if it is
    not used (and thus the risk is solely on users requiring that
    functionality).

  • bugfix: rate-limiting inside imuxsock did not work 100% correct
    reason was that a global config variable was invalidly accessed where a
    listener variable should have been used.
    Also performance-improved the case when rate limiting is turned off (this
    is a very unintrusive change, thus done directly to the stable version).

  • bugfix: $myhostname not available in RainerScript (and no error message)
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=233

  • bugfix: memory and file descriptor leak in stream processing
    Leaks could occur under some circumstances if the file stream handler
    errored out during the open call. Among others, this could cause very
    big memory leaks if there were a problem with unreadable disk queue
    files. In regard to the memory leak, this
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=256

  • bugfix: doc for impstats had wrong config statements
    also, config statements were named a bit inconsistent, resolved that
    problem by introducing an alias and only documenting the consistent
    statements
    Thanks to Marcin for bringing up this problem.

  • bugfix: IPv6-address could not be specified in omrelp
    this was due to improper parsing of “:”
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=250

  • bugfix: TCP connection invalidly aborted when messages needed to be
    discarded (due to QUEUE_FULL or similar problem)

  • bugfix: $LocalHostName was not honored under all circumstances
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=258

  • bugfix(minor): improper template function call in syslogd.c

legacy options support

adisconteamNews,

Via the compatibility mode option (-c), rsyslog still supports legacy options (like -t to start a tcp listener). This code complicates a couple of things quite a bit, especially in regard to the config system.

We are very tempted to drop support for legacy options in v6. That could lead to smaller and simpler code. Also, we think it is acceptable that someone running v6 finally moves away from the sysklogd/rsyslog v1 style of configuration via command line options.

We also noticed that the average user seems to have problems identifying where each distro places the actual call to rsyslogd, so users seem to prefer configuring all options inside the main configuration file (what we tend to think to be more useful as well).

Does anyone has a good argument why to retain the legacy support in v6? If so,please make yourself heard, because otherwise we’ll probably drop that support.

Best regards,
Rainer Gerhards

Scroll to top