rsyslog Windows Agent 8.4a Released
Adiscon has released rsyslog Windows Agent 8.4a, a maintenance update for the rsyslog Windows Agent 8.4 line.
This update ships Service 8.4.0.241 and Client 8.4.0.335. It updates the included OpenSSL libraries to version 3.5.9 and includes maintenance for the Syslog Listener.
Changes
- Updated the included OpenSSL libraries to version 3.5.9.
- Syslog Listener: Bounded header parsing to prevent malformed messages from interrupting service availability.
Details are in the version history. The versioned installer is rsyslog Windows Agent 8.4a.
rsyslog Windows Agent 26.11: Monthly Patch + Feature Drop
rsyslog Windows Agent 26.11 is the latest monthly Patch + Feature Drop. It adds manual hostname mappings and corrects Syslog Listener handling, TLS forwarding, remote configuration, and service diagnostics.
Map hostnames and IP addresses
General settings can define hostname and IP address mappings. The mappings are available in the Configuration Client and in the User Interface.
Safer forwarding and configuration
The Syslog Listener rejects malformed message headers. TLS and DTLS forwarding verify destination certificates and identities, and stalled TLS forwarding no longer blocks shutdown indefinitely. Remote configuration rejects invalid HTTPS certificates and insecure redirects. Registry configuration detects the default license file more reliably when the license path is empty and no separate data directory is configured. When a listening socket cannot be opened, diagnostics include possible owners. The Configuration Client and the User Interface do not save a partial configuration after loading fails, and they preserve existing settings when a selective import fails. The Syslog action can set the TLS send progress timeout. The User Interface dashboard displays content in the selected language.
The User Interface remains in preview. It is available for production use with appropriate care and review; the Configuration Client remains fully supported.
We recommend keeping rsyslog Windows Agent on the latest Patch + Feature Drop to benefit from current maintenance and product improvements. Your licence remains valid for releases in its calendar year; Upgrade Insurance provides entitlement to later calendar years and their monthly Patch + Feature Drops.
Build information
- Service: 26.11.0.357
- Configuration Client: 26.11.0.446
- User Interface: 26.11.0.1020
Read the Technical Release Notes for rsyslog Windows Agent 26.11 for detailed upgrade guidance, product scope, and verification steps.
rsyslog 8.2610.0 Released
Scheduled-stable releases are bi-monthly snapshots of the daily-stable branch,
providing predictable update points with the same functional content as
daily-stable at the time of the snapshot.
Highlights
- Experimental producer-local queue scope for improved queue concurrency
- New Amazon Kinesis Data Streams output via
omkinesis - Global strict input startup policy via
inputStartupPolicy="require-all" - OpenSSL 4 X.509 accessor compatibility
- Improved asynchronous
omfilerotation reliability - Queue contention and Elasticsearch request-duration statistics
- Expanded Enterprise Linux packaging, including an
imhttpsubpackage - Broad defensive hardening across queues, parsers, inputs, TLS, and outputs
Notable changes
Queues, concurrency, and reliability
- Experimental
queue.scope="local"places bounded producer-specific front
queues ahead of shared FixedArray or LinkedList backends, including disk
assistance. Global scope remains the default. - Queue processing received extensive reliability and performance work,
including targeted worker wakeups, improved disk-assisted worker restart
handling, safer shutdown behavior, and reduced shared-lock overhead. - Optional queue mutex contention statistics expose contention counts and
observed wait time through impstats. - Existing classic disk queues retain their supported serialization format;
Darwin ARM64 serialization now uses the expected fixed calling convention.
Inputs and startup policy
global(inputStartupPolicy="require-all")can make configured input startup
failures fatal, including listener and worker failures. The default remains
best-effort startup.imtcpdefers regex framing checks until a line boundary, reducing repeated
scans for fragmented input.imudpvalidates receive-buffer dimensions before startup, preventing invalid
allocation and offset arithmetic.imrelprejects framing sizes beyond librelp’s supported limit.
Outputs and integrations
- The new
omkinesisaction sends signed KinesisPutRecordrequests with
configurable streams, regions, credentials, payload templates, and fixed or
template-based partition keys. RainerScript and YAML configurations are
supported. - Asynchronous
omfileoutput now remains active across size-based rotation
and avoids shutdown hangs and rotation races. mmaitagadds response-size, request-timeout, connect-timeout, and low-speed
budgets while keeping provider response bodies out of failure diagnostics.omelasticsearchexposes request counts, duration, and interval minimum and
maximum duration through impstats.- The starter PostgreSQL schema accepts longer Docker and journald-style tags.
Normalization, parsing, and TLS
mmnormalizepreserves complete TurboVM results, including nested JSON and
null values, and reports truncated results throughturbo.truncated.- RainerScript replacement and template substring results are bounded safely,
including negative substring endpoints and large regex-match offsets. - Empty compressed records, oversized diagnostics, and raw message offsets are
validated before use. - TLS certificate handling supports newer OpenSSL X.509 accessors while
retaining compatibility with older OpenSSL versions. - DTLS sessions that fail peer verification are closed instead of retained.
Broken forwarding TLS sessions are explicitly aborted before descriptor reuse.
Overall hardening and security maintenance
This release includes broad defensive hardening across parsers, message
handling, queues, inputs, TLS/DTLS, compression, configuration validation, and
output actions.
It also incorporates security and robustness fixes accumulated in daily-stable
since the previous scheduled-stable release. These include bounds checks,
safer malformed-input handling, stricter certificate and peer validation,
safer dynamic paths, improved queue recovery, and protection against crashes,
resource exhaustion, busy loops, and unsafe shutdown behavior.
Compatibility notes
- Producer-local queue scope is experimental and opt-in. It requires lock-free
64-bit atomics and monotonic condition variables; global queue scope remains
the default. inputStartupPolicy="require-all"is opt-in. Existing configurations retain
best-effort startup behavior unless the strict policy is enabled.- New Kinesis output support requires the corresponding optional build
dependencies when enabled.
Contributors
Thanks to everyone who contributed to this release, including:
- Andreas Hasenack
- F3dor
- FLAK-ZOSO
- Galaxy Roaming
- hanjinpeng
- Jérémie Jourdin
- Mattia Marchese
- owen-rote
- Peter de Ridder
All other changes were contributed by Adiscon GmbH.
Artifact availability
The rsyslog 8.2610.0 source release is available from the usual rsyslog download locations. Packages and container images may appear with some delay while downstream publishing completes.
rsyslog Windows Agent 26.10: Monthly Patch + Feature Drop
rsyslog Windows Agent 26.10 is the latest monthly Patch + Feature Drop. It updates the included OpenSSL libraries and corrects configuration editing and service diagnostics in the User Interface.
Safer configuration editing
The User Interface validates Workbench edits before saving and restores the previous document if a save fails. Unsaved changes are kept in view when you leave, reload, switch the configuration source, or restart. Rule moves, remote-target protection, configuration-tree navigation, and debug-log follow are corrected, and the empty Advanced page is removed.
Updated OpenSSL
Included OpenSSL libraries are updated to 3.5.9.
The User Interface remains in preview. It is available for production use with appropriate care and review; the Configuration Client remains fully supported.
We recommend keeping rsyslog Windows Agent on the latest Patch + Feature Drop to benefit from current maintenance and product improvements. Your licence remains valid for releases in its calendar year; Upgrade Insurance provides entitlement to later calendar years and their monthly Patch + Feature Drops.
Build information
- Service: 26.10.0.354
- Configuration Client: 26.10.0.443
- User Interface: 26.10.0.1018
Read the Technical Release Notes for rsyslog Windows Agent 26.10 for detailed upgrade guidance, product scope, and verification steps.
libfastjson 1.2609.0 release
libfastjson 1.2609.0 improves object-member lookup performance, corrects buffered JSON dumping edge cases, and updates build compatibility and quality coverage.
Highlights
- Speed up object member lookup by traversing child pages directly.
- Fix buffered JSON dumping with zero-sized and small caller-provided workspaces.
- Ensure correct linking with
libmon glibc 2.42 and later. - Correct transposed
calloc()arguments that trigger warnings with newer compilers. - Clarify string-buffer lifetime and thread-safety guarantees in the API documentation.
- Expand correctness tests, fuzzing, and cross-platform CI coverage.
Download the Latest Version:
The new version of libfastjson can be downloaded from: libfastjson 1.2609.0 Download
Checksum (sha256sum): 7cd6f78c1c07f4140f6976a9a0e0048bcaa7292329c6ac2c0e070383d83d8edd
rsyslog Windows Agent 26.09: Monthly Patch + Feature Drop
rsyslog Windows Agent 26.09 is the latest monthly Patch + Feature Drop. It focuses on dependable service operation and smoother configuration administration.
More dependable service operation
The service now keeps a stop request effective even when it overlaps a configuration reload. Services installed with a custom Windows service name also start more reliably.
Smoother configuration administration
The User Interface preserves unsaved configuration changes when you restart as administrator, so you can review and save your work after elevation. After local metrics setup, standard users can reload their configuration without needing to restart as administrator. This release also includes stability maintenance for timestamp and configuration handling.
The User Interface remains in preview. It is available for production use with appropriate care and review; the Configuration Client remains fully supported.
We recommend keeping rsyslog Windows Agent on the latest Patch + Feature Drop to benefit from current maintenance and product improvements. Your licence remains valid for releases in its calendar year; Upgrade Insurance provides entitlement to later calendar years and their monthly Patch + Feature Drops.
Read the Technical Release Notes for rsyslog Windows Agent 26.09 for detailed upgrade guidance, product scope, and verification steps.
rsyslog 8.2608.0 Released
We are pleased to announce the release of rsyslog 8.2608.0. This release packs a massive wave of improvements, introducing native Kubernetes log tailing, a new AWS CloudWatch Logs output module, modernized storage engine features, and substantial defensive hardening across core protocols and inputs.
Below is a detailed breakdown of what’s new and improved in this cycle.
Key Highlights & Major Features
- Native Kubernetes Log Input (
imkubernetes) A brand-new input module that directly tails container and pod log files from the host filesystem. It seamlessly parses CRI and Dockerjson-fileformats, handles CRI partial-record reassembly, and enriches log events with Kubernetes API metadata. - AWS CloudWatch Logs HLC Output (
omawslogshlc) Introduces native support for streaming logs directly to Amazon CloudWatch via the HTTP Log Collector (HLC) endpoint using bearer-token authentication. Events are efficiently batched per transaction using standard rsyslog action retry paths. - Segmented Disk Queues & Maintenance Utility Disk-assisted queues (
FixedArrayandLinkedList) now leverage the segmented disk engine by default for new stores while safely maintaining existing classic backlogs. Alongside this update, a new segmented queue maintenance utility is now packaged to inspect stores, export lossless JSONL, and perform offline queue repairs. - Performance:
mmnormalizeTurboVM Acceleration When compiled againstliblognorm2.1.0+ with TurboVM enabled,mmnormalizenow supports accelerated worker normalization (turbo="on") and lazy JSON materialization for significantly higher throughput. - Modernized Network ACLs (
allowedSender) Bothimtcpandimudpnow support modern array-basedallowedSenderdirectives at both module and input scopes, giving operators flexible IP-filtering without relying on legacy configuration constructs.
Security, Hardening & Defensive Enhancements
- Dynamic File Path Containment (
omfile): By default,dynaFilepaths derived from message content are now lexically contained within their configured base directory to prevent path traversal issues. - Symlink Controls (
omfile& Disk Queues):omfileadds afollowSymlinkscontrol managed by the secure compatibility policy, while disk queue spools now explicitly reject final-component symlinks. - TLS URI & Security Upgrades (
omfwd,omelasticsearch):omfwd/osslsupportspkcs11:URIs with automatic log sanitization for sensitive PIN attributes.omelasticsearchgains modern TLS controls (tls.tlsversion,tls.ciphersuites,tls.keyexchangegroups), including post-quantum cryptography (PQC) hybrid key exchanges. - Input Resource Guardrails:
imbeats: Added resource and protocol guardrails (memory accounting, compressed payload bounds, receive deadlines) and fixed a issue where failed TLS handshakes could leave listeners disarmed.imhttp/imptcp: Added body size checks after gzip decompression and tightened regex-framing recovery to prevent negative length calculation errors.impcap: Added explicit bounds checks on ARP/RARP packet address lengths.
Kubernetes & Cloud Infrastructure Refinements
mmkubernetesEnhancements:- Added Kubernetes API URL failover across multiple endpoints using array syntax.
- Dynamic ServiceAccount token refreshing at configurable intervals (with 401 retries) to support automatic token rotation without daemon restarts.
- Opt-in/opt-out namespace metadata via
includeNamespaceMetadatato reduce memory and lookup overhead when pod enrichment is sufficient.
- Opt-in
systemdREADY Delay: The newsystemd.notifyReadyDelay="on"setting allows rsyslog to delay signalingREADY=1to systemd until opt-in inputs (likeimfile) finish loading state files and setup work.
Engine, Scripting & Stability Fixes
- RainerScript String Escaping: Modernized string parsing to accept standard
\xhhhexadecimal escapes uniformly across all expression, procedure, and object parameters. - Core Crash Guard:
msgSetPropViaJSON()now safely ignores JSONnullvalues instead of dereferencing null pointers, fixing edge-case crashes triggered viammexternal,mmlua, orpmnormalize. - Sub-Second Delay Fix (
imfile): Corrected byte/time order handling indelay.message, ensuring millisecond values (e.g.,1000) delay for 1ms rather than 1000 seconds. - Journal CPU Loop Prevention (
imjournal): Resolved an issue where journal rotations or invalidations caused a high-CPU busy loop during handle recovery. - Disabled Actions Optimization: Actions marked with
config.enabled="off"no longer instantiate sub-modules or execute setup side effects.
Availability
The rsyslog 8.2608.0 source release is available from the usual rsyslog download locations. Packages and container images may appear with some delay while downstream publishing completes.
Thank you
As always, a huge thank you to all contributors, developers, and users who submitted bug reports, code updates, and feature requests for this release!
rsyslog Windows Agent 26.08: Monthly Patch + Feature Drop
rsyslog Windows Agent 26.08 is available now. This monthly Patch + Feature Drop gives Windows log-forwarding teams a clearer view of selected messages, more flexible file monitoring in supported editions, and maintenance improvements for dependable event collection and forwarding.
Faster insight into selected messages
Operators can now view a selected set of stored log and event messages directly in the User Interface. This makes it easier to check what is being processed without leaving the product workflow.
More flexible collection and forwarding
In supported editions, file monitoring can now match files across nested paths with multiple wildcard components, helping teams cover dynamic directory structures with less configuration overhead. 26.08 also improves Event Log monitoring reliability during shutdown and recovery conditions.
Plan your update
The User Interface remains in preview and can be used in production with appropriate care and validation for the individual environment. The Configuration Client remains fully supported.
We recommend keeping rsyslog Windows Agent on the latest Patch + Feature Drop to benefit from current maintenance and product improvements. Consult the rsyslog Windows Agent documentation, then download rsyslog Windows Agent.
rsyslog 8.2606.0: stream compression, Elastic Beats input, and ongoing defensive hardening
We have released rsyslog 8.2606.0, the June 2026 scheduled-stable version. Scheduled-stable releases are bi-monthly snapshots of the daily-stable branch, providing predictable update points with the same functional content as daily-stable at the time of the snapshot.
The main theme of this release is operational robustness under pressure: reducing forwarding bandwidth with experimental stream compression, adding Elastic Beats input support for selected pipeline use cases, and continuing the defensive hardening work across the code base.
The three changes that deserve the most attention are:
- Experimental TCP stream compression for
omfwdtoimtcp - New Elastic Beats / Lumberjack input module via
imbeats - Continued defensive hardening and reliability work
Rsyslog Windows Agent 8.4 Released
A new version of the rsyslog Windows Agent is now available. Version 8.4.0 brings native configuration import/export options, improved service stability, and multiple client bug fixes.
Core Service Engine Updates
In the core engine, a critical concurrency fix has been applied to both the Syslog and RELP forwarding actions. The update resolves shared disk-queue rewrite race conditions that previously occurred when multiple forwarding actions were configured to use the same queue directory simultaneously, ensuring greater data integrity during high-load forwarding scenarios.
Configuration Client Enhancements
Native YAML Support
The Configuration Client now natively supports importing and exporting YAML configuration files. This functionality is fully aligned with the service runtime loader, streamlining configuration backups and migrations across environments.
Reliability & Configuration Handling
Registry-based configuration loading has been hardened to handle fresh installations and incomplete registry data smoothly. Additionally, when encountering unknown configuration blocks—such as those introduced by newer service versions—the client now gracefully skips them with a clear warning rather than failing to load.
Service Management & Stability
Service control logic has been overhauled to handle edge cases such as orphan processes, access control issues, and transitional service states. Administrators now have access to optional process termination options and a direct shortcut to Windows Services.
Timeout messaging during start and stop operations has been clarified for cases where the client stops waiting before Windows completes the service transition. The status bar now explicitly tracks states like Stopping, Starting, and Paused (Reloading), and false stop-timeout errors—where the service had already reached a stopped state—have been eliminated.
Additionally, the Event Viewer now prepends new events following start, stop, restart, or reload actions rather than clearing the existing list, while background threading has been improved to recover cleanly from aborted operations. A client crash on shutdown involving open Event Viewer or Service Management panels has also been resolved.
Released versions
- Service: 8.4.0.239
- Client: 8.4.0.334