rsyslog

The rocket-fast system for log processing pipelines

Author : Adiscon Support

Main Advantages of rsyslog v7 vs. v5

By Adiscon SupportPosted on Posted in News, Top NewsTagged , , , , , , , , , ,

Why rsyslog V7:

  • greatly improved configuration language – the new language is much more intuitive than the legacy format. It will also prevent some typical mistakes simply by not permitting these invalid constructs. Note that legacy format is still fully supported (and you can of course do the same mistakes if you use legacy format).
  • greatly improved execution engine – with nested if/then/else constructs as well as the capability to modify variables during processing.
  • full support for structured logging and project lumberjack / CEE – this includes everything from being able to create, interpret and handle JSON-based structured log messages, including the ability to normalize legacy text log messages.
  • more plugins – like support for MongoDB, HDFS, and ElasticSearch as well as for the kernel’s new structured logging system.
  • higher performance – many optimizations all over the code, like 5 to 10 times faster execution time for script-based filters, enhanced multithreaded TCP input plugin, DNS cache and many more.

Of course, there are many more improvements. This list contains just the most important ones. For full details, check the file ChangeLog.

How to use rsyslog and MongoDB

By Adiscon SupportPosted on Posted in FAQTagged , ,

rsyslog is since version 6.1.3 capable of using a output module called “ommongodb” to write log messages to mongodb. To achieve this, several packages are needed:

mongodb
mongodb-server
php-pecl-mongo
libmongo-client
libglib2.0-dev

These and of course rsyslog are needed. The packages are easily installed via a package manager. And the installation steps for rsyslog are the usual ones. Except for the “Configure”. Please make sure to include “–enable-ommongodb“. And the other features you plan to use of course.

./configure --libdir=/usr/lib --sbindir=/usr/sbin --enable-ommongodb
make
make install

After this, you need to make some adjustments to the rsyslog.conf. You need to load the module of course and configure an action:

module (load="ommongodb")
*.* action(type="ommongodb" server="127.0.0.1")

In this case we send everything to the local MongoDB server. With the default settings, this should work directly. No username or password is needed if it isn’t configured in MongoDB. And the “db” and “collection” will automatically be created. The default database that rsyslog will use is “syslog” and the default name for the collection is “log“. These can be changed by various parameters.

To review what is written to the database, simply open a command line and enter “mongo“. This is to open the MongoDB Shell. You now need to change the database that is used with

use syslog

That way all further commands will be used on the database that rsyslog uses. Next we let the shell show us the entries:

db.log.find()

Please make sure to use the exact command. Of course there are a lot of other commands that you may find useful. Or information on how to secure the database. Please refer to the MongoDB documentation for that.

rsyslog 7.1.8 (v7-beta) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , ,

The 7.1.x branch is now feature-complete, consequently this is the first beta release. From now on, 7.1.x will mature and only receive patches. New features will be introduced in the (soon to be opened) 7.3.x branch.

ChangeLog:

http://www.rsyslog.com/changelog-for-7-1-8-v7-beta/

Download:

http://www.rsyslog.com/rsyslog-7-1-8-v7-beta/

As always, feedback is appreciated.

Best regards,
Florian Riedl

Changelog for 7.1.8 (v7-beta)

By Adiscon SupportPosted on Posted in ChangelogTagged , , , ,

Version 7.1.8  [beta] 2012-10-02

  • bugfix: ruleset(){} directive errornously changed default ruleset much like the $ruleset legacy conf statement. This potentially lead to statements being assigned to the wrong ruleset.
  • improved module doc
  • added “parser” parameter to ruleset(), so that parser chain can be configured
  • implemented “continue” RainerScript statement

rsyslog 7.1.7 (v7-devel) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , ,

This release adds the “call” statement, a superior replacement to omruleset. It also provides array-based string comparison operations and the ability to configure TLS permitted peers via the new config language. The 7.1.x branch is now 99% feature-complete.

ChangeLog:

http://www.rsyslog.com/changelog-for-7-1-7-v7-devel/

Download:

http://www.rsyslog.com/rsyslog-7-1-7-v7-devel/

As always, feedback is appreciated.

Best regards,
Florian Riedl

rsyslog 7.1.6 (v7-devel) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , ,

This version implements the input() and ruleset() statements, which finally permit a config file to be written in new style only. A sample can be found at

http://blog.gerhards.net/2012/09/rsyslogs-new-input-statement-quick-look.html

 

ChangeLog:

http://www.rsyslog.com/changelog-for-7-1-6-v7-devel/

Download:

http://www.rsyslog.com/rsyslog-7-1-6-v7-devel/

As always, feedback is appreciated.

Best regards,
Florian Riedl

Scroll to top