rsyslog

The rocket-fast system for log processing

Author : Adiscon Support

Changelog for 8.11.0 (v8-stable)

By Adiscon SupportPosted on Posted in ChangelogTagged , , , , , , ,

Version 8.11.0 [v8-stable] 2015-06-30

  • new signature provider for Keyless Signature Infrastructure (KSI) added
  • build system: re-enable use of “make distcheck”
  • bugfix imfile: regex multiline mode ignored escapeLF option
    Thanks to Ciprian Hacman for reporting the problem
    closes https://github.com/rsyslog/rsyslog/issues/370
  • bugfix omkafka: fixed several concurrency issues, most of them related to dynamic topics.
    Thanks to Janmejay Singh for the patch.
  • bugfix: execonlywhenpreviousissuspended did not work correctly
    This especially caused problems when an action with this attribute was configured with an action queue.
  • bugfix core engine: ensured global variable atomicity
    This could lead to problems in RainerScript, as well as probably in other areas where global variables are used inside rsyslog. I wouldn’t outrule it could lead to segfaults.
    Thanks to Janmejay Singh for the patch.
  • bugfix imfile: segfault when using startmsg.regex because of empty log line
    closes https://github.com/rsyslog/rsyslog/issues/357
    Thanks to Ciprian Hacman for the patch.
  • bugfix: build problem on Solaris
    Thanks to Dagobert Michelsen for reporting this and getting us up to
    speed on the openCWS build farm.
  • bugfix: build system strndup was used even if not present now added compatibility function. This came up on Solaris builds.
    Thanks to Dagobert Michelsen for reporting the problem.
    closes https://github.com/rsyslog/rsyslog/issues/347

 

RSyslog Windows Agent 3.1 Released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , ,

Adiscon is proud to announce the 3.1 release of RSyslog Windows Agent.

This is a maintenenance release for RSyslog Windows Agent. It includes some bugfixes as well as a new rule date condition which can be used to process events starting from a certain date. A few new options have been added into the Syslog Service as well.

Detailed information can be found in the version history below.

Build-IDs: Service 3.1.0.134, Client 3.1.0.213

Features

  • All internal errors are now logged into the EventLog when “Event Warnings” are enabled in general options.
  • Added Rule Date Conditions. By default a rule will always be processed. It can be set to only process messages generated since the installation or custom date.
  • Syslog Server: Added new Option to save original source into custom property when using “Take Source system from Syslog message” option.
  • File Monitor: Files are now opened with FILE_SHARE_DELETE flag which enables other applications to delete them (like logrotation tools do).

Bugfixes

  • SSL Connections: Fixed an issue not using custom configured certificates when TLS anon mod was used.
  • FileConfig Mode: Fixed a bug loading filters properly. Also added support for reloading data variables automatically.
  • Core Engine: Fixed an internal processing bug caused when rebuilding Messages from cache files.
  • Syslog Server: RFC 5424 header parsing fixed, a timestamp can be a NILVALUE now.
  • Syslog Server: Fixed bug ignoring “Take Source system from Syslog message” option when UDP was used.

Version 3.1 is a free download. Customers with existing 2.x keys can contact our Sales department for upgrade prices. If you have a valid Upgrade Insurance ID, you can request a free new key by sending your Upgrade Insurance ID to sales@adiscon.com. Please note that the download enables the free 30-day trial version if used without a key – so you can right now go ahead and evaluate it.

rsyslog 8.10.0 (v8-stable) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , , , , ,

We have released rsyslog 8.10.0.

This provides a number of new features and fixes in several modules, like imfile, zmq and others. It also adds a new contributed module omhttpfs for writing to HDFS via HTTP.
ChangeLog:

http://www.rsyslog.com/changelog-for-8-10-0-v8-stable/

Download:

http://www.rsyslog.com/downloads/download-v8-stable/

As always, feedback is appreciated.

Best regards,
Florian Riedl

Changelog for 8.10.0 (v8-stable)

By Adiscon SupportPosted on Posted in ChangelogTagged , , , , , , , , ,

Version 8.10.0 [v8-stable] 2015-05-19

  • imfile: add capability to process multi-line messages based on regex input parameter “endmsg.regex” was added for that purpose. The new mode provides much more power in processing different multiline-formats.
  • pmrfc3164: add new parameters
    • “detect.yearAfterTimestamp”
      This supports timestamps as generated e.g. by some Aruba Networks equipment.
    • “permit.squareBracesInHostname”
      Permits to use “hostnames” in the form of “[127.0.0.1]”; also seen in Aruba Networks equipment, but we strongly assume this can also happen in other cases, especially with IPv6.
  • supplementary groups are now set when dropping privileges
    closes https://github.com/rsyslog/rsyslog/issues/296
    Thanks to Zach Lisinski for the patch.
  • imfile: added brace glob expansion to wildcard
    Thanks to Zach Lisinski for the patch.
  • zmq: add the ability for zeromq input and outputs to advertise their presence on UDP via the zbeacon API.
    Thanks to Brian Knox for the contribution.
  • added omhttpfs: contributed module for writing to HDFS via HTTP
    Thanks to sskaje for the contribution.
  • Configure option “–disable-debug-symbols” added which is disabled per default. If you set the new option, configure won’t set the appropriate compiler flag to generate debug symbols anymore.
  • When building from git source we now require rst2man and yacc (or a replacement like bison).
    That isn’t any new requirement, we only added missing configure checks.
  • Configure option “–enable-generate-man-pages” is now disabled for non git source builds per default but enforced when building from git source.
  • mmpstrucdata: some code cleanup
    removed lots of early development debug outputs
  • bugfix imuxsock: fix a crash when setting a hostname
    Setting a hostname via the legacy directive would lead to a crash during shutdown caused by a double-free.
    Thanks to Tomas Heinrich for the patch.
  • bugfix: memory leak in mmpstrucdata
    Thanks to Grégoire Seux for reporting this issue.
    closes https://github.com/rsyslog/rsyslog/issues/310
  • bugfix (minor): default action name: assigned number was one off
    see also https://github.com/rsyslog/rsyslog/pull/340
    Thanks to Tomas Heinrich for the patch.
  • bugfix: memory leak in imfile
    A small leak happened each time a new file was monitored based on a wildcard. Depending on the rate of file creation, this could result in a serious memory leak.

rsyslog 8.9.0 (v8-stable) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , , , , , ,

We have released rsyslog 8.9.0.

This is primarily a bug-fixing release with a couple of improvements in omprog, imuxsock and the zero message queue plugins.
ChangeLog:

http://www.rsyslog.com/changelog-for-8-9-0-v8-stable/

Download:

http://www.rsyslog.com/downloads/download-v8-stable/

As always, feedback is appreciated.

Best regards,
Florian Riedl

Changelog for 8.9.0 (v8-stable)

By Adiscon SupportPosted on Posted in ChangelogTagged , , , , , , , ,

Version 8.9.0 [v8-stable] 2015-04-07

  • omprog: add option “hup.forward” to forwards HUP to external plugins
    This was suggested by David Lang so that external plugins (and other
    programs) can also do HUP-specific processing. The default is not
    to forward HUP, so no change of behavior by default.
  • imuxsock: added capability to use regular parser chain
    Previously, this was a fixed format, that was known to be spoken on
    the system log socket. This also adds new parameters:

    • sysSock.useSpecialParser module parameter
    • sysSock.parseHostname module parameter
    • useSpecialParser input parameter
    • parseHostname input parameter
  • 0mq: improvements in input and output modules
    See module READMEs, part is to be considered experimental.
    Thanks to Brian Knox for the contribution.
  • imtcp: add support for ip based bind for imtcp -> param “address”
    Thanks to github user crackytsi for the patch.
  • bugfix: MsgDeserialize out of sync with MsgSerialize for StrucData
    This lead to failure of disk queue processing when structured data was
    present. Thanks to github user adrush for the fix.
  • bugfix imfile: partial data loss, especially in readMode != 0
    closes https://github.com/rsyslog/rsyslog/issues/144
  • bugfix: potential large memory consumption with failed actions
    see also https://github.com/rsyslog/rsyslog/issues/253
  • bugfix: omudpspoof: invalid default send template in RainerScript format
    The file format template was used, which obviously does not work for
    forwarding. Thanks to Christopher Racky for alerting us.
    closes https://github.com/rsyslog/rsyslog/issues/268
  • bugfix: size-based legacy config statements did not work properly
    on some platforms, they were incorrectly handled, resulting in all
    sorts of “interesting” effects (up to segfault on startup)
  • build system: added option –without-valgrind-testbench
    … which provides the capability to either enforce or turn off
    valgrind use inside the testbench. Thanks to whissi for the patch.
  • rsyslogd: fix misleading typos in error messages
    Thanks to Ansgar Püster for the fixes.

RSyslog Windows Agent 3.0 Released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , ,

Adiscon is proud to announce the 3.0 release of RSyslog Windows Agent.

This new major release adds full support for Windows 2012 R2 and also has been verified to work on Windows 10 preview versions.

The new major version is a milestone in many ways. Most important the performance of the core engine has been considerably increased. All existing configurations will benefit from this. Also a new Configuration Client has been added which has been rewritten using the .Net Framework (Like the InterActive Syslog Viewer). With the new Configuration Client, we also introduce support for a new file based configuration format (as an alternative to the registry-based method). RSyslog Windows Agent can now run from a configuration file and save it state values
into files.

We also extended the classic EventLog Monitor to support multiple dynamic *.evt files for NetApp customers.

Detailed information can be found in the version history below.

Build-IDs: Service 3.0.130, Client 3.0.201

Features

  • Faster core engine
  • New Configuration Client running on Microsoft .Net Framework. If wanted, the old client application can be installed manually as “RSyslog Windows Agent Legacy Client”.
  • The Agent can be switched from registry to file based configuration support. Requires usage of the new configuration client.
  • EventLog Monitor Classic(V1): Support for dynamic Eventlog files added.
    Kindly use an asterix (*) in the eventlog filename to activate it, for example: \\netappdevice\c$\etc\log\adtlog.*.evt
    When activated, EventLog Monitor will process all matching files automatically. The feature was primary added for NETAPP users who have dynamic filenames.
  • New System Property added to created UUID’s called “$NEWUUID”. Generates a random generated 128Bit UUID (Universally Unique Identifiers).

Bugfixes

  •  none

Version 3.0 is a free download. Customers with existing 2.x keys can contact our Sales department for upgrade prices. If you have a valid Upgrade Insurance ID, you can request a free new key by sending your Upgrade Insurance ID to sales@adiscon.com. Please note that the download enables the free 30-day trial version if used without a key – so you can right now go ahead and evaluate it.

rsyslog daily builds and tarballs

By Adiscon SupportPosted on Posted in News, Top NewsTagged ,

The past days, we have worked on making rsyslog daily builds and tarballs a reality. We hope this will enable users to rapidly deploy the latest features as well as make it easier to help with testing the current development system. Daily builds are what the scheduled v8-devel builds were under the previous release paradigm. Consequently, the archives are named v8-devel.

Right now, builds are only supported for Ubuntu. Users of other platforms are advised to use the daily tarballs to build from source. Depending on feedback on and success of the daily builds, we will make them available for more platforms.  

A daily build is based on the latest git master version. So it really is at the [b]leading edge of technology. So why create them?

A top reason is that we often fix a bug for someone, and that someone then is unable to build from source. In the end result, we have a bugfix, but there is no external confirmation that it really fixed the bug when we merge it into the next release. We hope that now those users can simply pick the daily build and check if that solves their problem.

Also, in general we hope that some users will use the daily tarballs to get not only the latest and greatest but contribute to the project by doing some testing.

Finally, and quite important, with daily builds we will see build problems as early as possible. In the past, we often saw problems only after source release (or very close to it), which was obviously problematic. Now, this should no longer happen. For obvious reasons, the final release build is now more or less a copy of a daily build.

As a technical side-note, daily builds are identified by the git master branch head hash that was used to build them. As a forth version component, they have the first 12 digits of that hash (an example is “8.8.0.35e7f12a2c04”). This enables us to track error reports to the right version. The packages have a different version name, based on the build date. The reason is that the hash does not increment and so newer versions (with lower hash values) are considered as “old” by Launchpad. We avoid this by using an always incrementing package version. Also note that the package changelog just contains a “daily build” entry — anything else makes limited sense.

We hope you enjoy this new feature! Feedback is appreciated.

rsyslog 8.7.0 (v8-stable) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , , , , , ,

We have released rsyslog 8.7.0.

Version 8.7.0 contains various improvements and additions to a wide array of modules, like imfile, imptcp, improvements to RainerScript and mmnormalize (thanks to Singh Janmejay) and a couple of other improvements. But, the biggest addition is the new omkafka module that now allows direct writing to Apache Kafka.

This release also contains important bug fixes.

This is a recommended upgrade for all users.

 

ChangeLog:

http://www.rsyslog.com/changelog-for-8-7-0-v8-stable/

Download:

http://www.rsyslog.com/downloads/download-v8-stable/

As always, feedback is appreciated.

Best regards,
Florian Riedl

Changelog for 8.7.0 (v8-stable)

By Adiscon SupportPosted on Posted in ChangelogTagged , , , , , , , ,

Version 8.7.0 [v8-stable] 2015-01-13

  • add message metadata “system” to msg object
    this permits to store metadata alongside the message
  • imfile: add support for “filename” metadata
    this is useful in cases where wildcards are used
  • imptcp: make stats counter names consistent with what imudp, imtcp uses
  • added new module “omkafka” to support writing to Apache Kafka
  • omfwd: add new “udp.senddelay” parameter
  • mmnormalize enhancements
    Thanks to Janmejay Singh for the patch.
  • RainerScript “foreach” iterator and array reading support
    Thanks to Janmejay Singh for the patch.
  • now requires liblognorm >= 1.0.2
  • add support for systemd >= 209 library names
  • BSD “ntp” facility (value 12) is now also supported in filter
    Thanks to Douglas K. Rand of Iteris, Inc. for the patch.
    Note: this patch was released under ASL 2.0 (see email-conversation).
  • bugfix: global(localHostName=”xxx”) was not respected in all modules
  • bugfix: emit correct error message on config-file-not-found
    closes https://github.com/rsyslog/rsyslog/issues/173
  • bugfix: impstats emitted invalid JSON format (if JSON was selected)
  • bugfix: (small) memory leak in omfile’s outchannel code
    Thanks to Koral Ilgun for reporting this issue.
  • bugfix: imuxsock did not deactivate some code not supported by platform
    Among potential other problemns, this caused build failure under Solaris.
    Note that this build problem just made a broader problem appear that so
    far always existed but was not visible.
    closes https://github.com/rsyslog/rsyslog/issues/185
Scroll to top