rsyslog

The rocket-fast system for log processing

Author : Adiscon Support

How to create debug information with strace

By Adiscon SupportPosted on Posted in FAQTagged , ,

Strace is a tool to monitor system calls of an application. The output may be useful to trace what rsyslog is actually doing on the system level, if debug output information is not sufficient.

A quick example to provide useful output would be:

strace -T -ttt -f -o /path/filename rsyslogd

There are a lot of parameters that can be set. For example we can also only monitor system calls related to the network components:

strace -T -ttt -e trace=network -f -o /path/filename rsyslogd

For more details, please visit the man page of strace.

RSyslog Windows Agent 4.1 Released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , ,

Adiscon is proud to announce the 4.1 release of MonitorWare Agent.

Rsyslog Windows Agent is now able to reload it’s configuration automatically if enabled (Which is done by the configuration client
automatically on first start). It is not necessary to restart the service manually anymore.

Performance enhancing options have been added into EventLog Monitor V1 and V2 and in File Monitor to delay writing the last record/fileposition back to disk. This can incease performance on machines with a very high eventlog or file load.

Detailed information can be found in the version history below.

Build-IDs: Service 4.1.0.166, Client 4.1.0.246

Features

  • Updated to OpenSSL 1.0.2k.
  • Configuration Reload: This is a big new core feature allowing the
    service to reload itself automatically after a configuration changed has
    been detected. The feature can be turned off in General-General Options if
    this new behavior is not wanted. By default auto reload will be enabled.
    The latest Configuration Client is required for the feature to fully work.
  • EventLog Monitor V2: Added new options to delay LastRecord save.
    Enabling this option will improve processing performance of machines with
    a high event volume.
  • EventLog Monitor V1: Added new option to delay LastRecord save. Enabling
    this option will improve processing performance of machines with a high
    event volume.
  • File Monitor: Added new option to delay LastFilePosition save. Enabling
    this option will improve processing performance when processing large
    growing files.
  • FileConfig: Changed datafile saving method, more reliable when the
    service is stopped unintentionally while updating data state files.
  • Send Syslog Action: Added new option to enable/disable UTF8 BOM. Default
    is enabled like before, but it can be disabled now by configuration so the
    message won’t contain the UTF8 BOM.

Bugfixes

  • Property Engine: Fixed SystemID and CustomerID properties.v
  • FileConfig: Due a missing property (FilterVersion), some of the global
    conditions in rule filters could not be used. This automatically fixes
    itself next time the configuration is saved with the Client.
  • Debug Logging: Completely rewritten debug output for Rule Engine
    (Filters) for better readability and analysis.
  • Fixed an compatibility issue on Windows 2003/XP (failed to start because
    WSAPoll API is missing).
  • FileConfig: Fixed an issue with invalid linefeeds when using includefile
    directive.
  • FileConfig: Fixed EnumRegkey emulation causing EventLog Monitor Services
    to load invalid eventlog channels.
  • Debug Logging: Moved RELP Debugging from minimal to internal
  • FileMonitor: Fixed issue rewriting filepointer updates each time when
    wildcards support was enabled.

Version 4.1 is a free download. Customers with existing 3.x keys can contact our Sales department for upgrade prices. If you have a valid Upgrade Insurance ID, you can request a free new key by sending your Upgrade Insurance ID to sales@adiscon.com. Please note that the download enables the free 30-day trial version if used without a key – so you can right now go ahead and evaluate it.

rsyslog 8.25.0 (v8-stable) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , ,

We have released rsyslog 8.25.0.

This release brings quite a number of changes and fixes. The most notable is that imfile now supports wildcards in directory names, which permits to monitor newly created directories without making changes to the configuration.

For a complete list of changes, fixes and enhancements, please visit the ChangeLog.

ChangeLog:

rsyslog 8.24.0 (v8-stable) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , , , , , , ,

We have released rsyslog 8.24.0.

This first release for 2017 brings a lot of changes. Most are detail enhancements for different modules. The biggest change is probably, that rsyslog now builds on the AIX platform.  Also 8.24.0 has two new message modification modules, which might be worth checking out. And a very useful addition is the ability to bind imudp and omfwd to a specific device.

For a complete list of changes, fixes and enhancements, please visit the ChangeLog.

ChangeLog:

RSyslog Windows Agent 4.0 Released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , ,

Adiscon is proud to announce the 4.0 release of RSyslog Windows Agent.

RSyslog Windows Agent now fully supports Windows Server 2016 and is ready to be used in the most demanding environments.

Also, the latest RELP subsystem is now supported. As another highlight, internationalization has been enhanced by even better support and automatic detection of various character sets, including for example Japanese.

Detailed information can be found in the version history below.

Build-IDs: Service 4.0.0.160, Client 4.0.0.240

Features

  • Added Windows 2016 Support.
  • Updated Syslog RFC3195 liblogging library
  • Updated librelp library to 1.2.11
  • File Monitor: Added support for UTF16 Big Endian

Bugfixes

  • File Configuration: Fixed an issue loading file configuration when invalid characters where within config files like UTF8 BOM.
  • Syslog Server: Fixed internal issue when receiving empty syslog messages.

Version 4.0 is a free download. Customers with existing 3.x keys can contact our Sales department for upgrade prices. If you have a valid Upgrade Insurance ID, you can request a free new key by sending your Upgrade Insurance ID to sales@adiscon.com. Please note that the download enables the free 30-day trial version if used without a key – so you can right now go ahead and evaluate it.

rsyslog 8.23.0 (v8-stable) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , , , , , ,

We have released rsyslog 8.23.0.

This release is packed with changes and enhancements. One of the most interesting might be the removal of the SHA2-224 hash algorithm for KSI signatures. This is considered insecure and is no longer supported by the KSI library. Also notable are the changes to imfile, omfile and omelasticsearch, among lots of others. Please take a look at the Changelog for a full overview.

Note: We delayed the next release by two weeks to the Jan 10, so we don’t have to deal with a release around the Christmas holidays. This also means that 8.23.0 is the final release for 2016.
ChangeLog:

rsyslog 8.22.0 (v8-stable) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , ,

We have released rsyslog 8.22.0.

This release is mostly for maintenance. It has a somewhat improved error output for config file syntax errors, a bugfix for omhiredis and general code cleanup and improvment. The only new function is the added template support for ompgsql.

To get a full overview over the changes, please take a look at the Changelog.
ChangeLog:

RSyslog Windows Agent 3.3 Released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , , , ,

Adiscon is proud to announce the 3.3 release of RSyslog Windows Agent.

This is a bugfixing release with minor feature update.

Most importantly, the Adiscon SNMP MIB now supports messages sizes up to 64k (previous limit was 255 characters). The OpenSSL Library has been updated to 1.0.2h. Bugs were fixed primarily in RELP and syslog forwarding processing. For details please see the change log.

Detailed information can be found in the version history below.

Build-IDs: Service 3.3.152, Client 3.3.235

Features

  • Components:
    • OpenSSL library updated to 1.0.2h.
  • Adiscon SNMP Mib:
    • Changed DisplayString limit from 255 characters to 65536. Now, strings above 255 characters can be send using the adiscon mibs.

Bugfixes

  • Send Syslog Action:
    • Fixed an issue with the “Disable processing, forward as it is” Option. RawSyslogMsg property is used instead of msg property.
  • Send Relp Action:
    • Fixed an issue in the Session Close shutdown procedure which could lead to leaking sessions on Relp Servers.
    • Send Relp Action: Fixed an issue setting a proper status on failure.
    • Fixed a problem handling socket failures.
  • Event Monitor V2:
    • Dynamic properties could break XML format if they contained spaces in their name. Spaces and control characters are now properly replaced with underscores.
  • Relp Listener:
    • Fixed Socketsystem startup if only one Relp Listener Service was configured without any other network related services.
  • Syslog Server:
    • Fixed an issue relaying the priority / facility properties on Syslog Forward. The prifac property was not properly recreated if the message source was Syslog.
    • Fixed an issue with RFC5424 header parsing which partially parsed invalid formatted syslog messages. This broke the original message.
    • Fixed a parsing issue (TCP Protocol only) when the syslog header was missing. When the first characters were a number, TCP Syslog tried to detect octet framing. This failed but the beginning characters of the message were lost. Also octet framing was not disabled resulting in unexpected endings of the message.
    • Fixed an issue with RFC 3164 Syslog Header parsing when “take syslog source from msg” is enabled.
  • Property Replacer:
    • Date related options are now evaluated before and after the property is truncated. But only if a match before the string truncation was not successful.

Version 3.3 is a free download. Customers with existing 2.x keys can contact our Sales department for upgrade prices. If you have a valid Upgrade Insurance ID, you can request a free new key by sending your Upgrade Insurance ID to sales@adiscon.com. Please note that the download enables the free 30-day trial version if used without a key – so you can right now go ahead and evaluate it.

rsyslog 8.21.0 (v8-stable) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , , ,

We have released rsyslog 8.21.0.

This release is mostly for maintenance. There was a big change to how internal messages are handled. These are no longer logged via the internal bridge, but via the syslog() API call. For regular users, this should make not too much difference.

Additionaly, the TLS syslog error messages have been improved, as well as the robustness of the queue subsystem.

To get a full overview over the changes, please take a look at the Changelog.
ChangeLog:

rsyslog 8.20.0 (v8-stable) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , , , ,

We have released rsyslog 8.20.0.

This release brings a few new additions and requirements. Omrelp now has a configurable connection timeout and pmrfc3164 has a new option to allow slashes in the hostname. Apart from that, there is quite a set of bugfixes.

Please note, to use rsyslog 8.20.0 it is required to update librelp to version 1.2.12.

To get a full overview over the changes, please take a look at the Changelog.
ChangeLog:
Scroll to top