Author : adisconteam

Changelog for 6.1.7 (v6-devel)

Version 6.1.7 [DEVEL] (rgerhards), 2011-04-15

  • added log classification capabilities (via mmnormalize & tags)
  • speeded up tcp forwarding by reducing number of API calls
    this especially speeds up TLS processing
  • somewhat improved documentation index
  • bugfix: enhanced imudp config processing code disabled due to wrong
    merge (affected UDP realtime capabilities)
  • bugfix (kind of): memory leak with tcp reception epoll handler
    This was an extremely unlikely leak and, if it happend, quite small.
    Still it is better to handle this border case.
  • bugfix: IPv6-address could not be specified in omrelp
    this was due to improper parsing of “:”
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=250

rsyslog 5.8.0 (v5-stable) released

This is the new v5-stable version. It contains all enhancements made to the 5.7.x versions. Among others, this includes support for systemd, enhancements for imfile, new custom parsers, UDP realtime reception support, Hadoop HDFS support and many other improvements. Please note that it also contains two bug fixes that are NOT present in 5.6.5.

ChangeLog:

http://www.rsyslog.com/changelog-for-5-8-0-v5-stable/

Download:

http://www.rsyslog.com/rsyslog-5-8-0-v5-stable/

As always, feedback is appreciated.

Best regards,
Tom Bergfeld

Changelog for 5.8.0 (v5-stable)

Version 5.8.0 [V5-stable] (rgerhards), 2011-04-12

This is the new v5-stable branch, importing all feature from the 5.7.x versions. To see what has changed in regard to the previous v5-stable, check the Changelog for 5.7.x below.

  • bugfix: race condition in deferred name resolution
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=238
    Special thanks to Marcin for his persistence in helping to solve this
    bug.
  • bugfix: DA queue was never shutdown once it was started
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=241

Changelog for 5.7.10 (v5-beta)

Version 5.7.10 [V5-BETA] (rgerhards), 2011-03-29

  • bugfix: ompgsql did not work properly with ANSI SQL strings
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=229
  • bugfix: rsyslog did not build with –disable-regexp configure option
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=243
  • bugfix: PRI was invalid on Solaris for message from local log socket
  • enhance: added $BOM system property to ease writing byte order masks
  • bugfix: RFC5424 parser confused by empty structured data
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=237
  • bugfix: error return from strgen caused abort, now causes action to be
    ignored (just like a failed filter)
  • new sample plugin for a strgen to generate sql statement consumable
    by a database plugin
  • bugfix: strgen could not be used together with database outputs
    because the sql/stdsql option could not be specified. This has been
    solved by permitting the strgen to include the opton inside its name.
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=195

Why does the rsyslog testbench sometimes fail?

Rsyslog contains a set of automatted tests, the so-called “testbench”. It is invoked via the standard method of “make check” and “make distcheck”. Since its introduction in version 3, the testbench has been continously enhanced and extended. It now contains around 150 individual tests, which sum up to around 80 tests from the autoconf point of view (some autoconf tests run a couple of subtests, thus the difference in number). The testbench has been proven to be very useful and caught numerous problems before new code was released.

But the testbench is not perfect, and it may sometimes fail without any actual problem. There are two reasons for this. One is that the test require a very specific environment. For example, some parser based tests assume that the system the test is run on is configured to be named “localhost.localdomain” (the default for many test deployments). This needs to be the case because there currently is no way in rsyslog to overwrite the local hostname. Some parser tests use malformed messages, in which case (as of the RFC), the local system name must be used. As such, we need to have a specific system name set in order to prove the results. In the long term, we’ll add the capability to overwrite system name inside rsyslog, but it does not make sense to create a dirty trick just for testbench use. So this needs to wait until we get to it as part of regular development. Note that a similar issues may exist at other places. An obvious one is the database tests, where we need pre-created users, databases, tables etc in order to run the tests.

The other issue is a bit more subtle. The syslog protocol is simply, without App-Layer acknowledgments. This makes it hard to know when rsyslog has received a while bunch of test data. That in turn makes it hard to definitely say when all test data has arrived and an instance can be shut down. So the whole process is a bit racy. To “solve” this, we use some wait periods in tests affected by this problem. However, longer wait periods mean longer test bench runtime and this reduces our development productivity. So we use wait time that usually does the job, but may fail under some circumstances (most notably when –enable-debug is set). This can affect a couple of TCP-based tests (like imtcp_conndrop.sh and similar ones). We have not yet a good idea what a clean solution to this problem is, where “clean” means that it a) always works and b) does no introduce unnecessary code complexity under non-testbench runs.

Given these problems, some care must be taken interpreting testbench results. Most importantly, a fail does not necessarily mean that things are actually broken. It merely means that one needs to look at the actual test and check a) why it fails and b) if it fails repeatedly. Especially the “racy” test tend to occasionally fail without any real problem. We’ve also seen them to fail consistenly on some platforms, simply because our timing assumptions are not valid there (Solaris was one example where we needed to adjust our overall wait periods).

So testbench results need to be taken with a grain of salt, and require interpretation. We know this is inconvenient for occasional users, but it is the best compromise we currently can offer.

Scroll to top