rsyslog Windows Agent 26.09: Monthly Patch + Feature Drop
rsyslog Windows Agent 26.09 is the latest monthly Patch + Feature Drop. It focuses on dependable service operation and smoother configuration administration.
More dependable service operation
The service now keeps a stop request effective even when it overlaps a configuration reload. Services installed with a custom Windows service name also start more reliably.
Smoother configuration administration
The User Interface preserves unsaved configuration changes when you restart as administrator, so you can review and save your work after elevation. After local metrics setup, standard users can reload their configuration without needing to restart as administrator. This release also includes stability maintenance for timestamp and configuration handling.
The User Interface remains in preview. It is available for production use with appropriate care and review; the Configuration Client remains fully supported.
We recommend keeping rsyslog Windows Agent on the latest Patch + Feature Drop to benefit from current maintenance and product improvements. Your licence remains valid for releases in its calendar year; Upgrade Insurance provides entitlement to later calendar years and their monthly Patch + Feature Drops.
Read the Technical Release Notes for rsyslog Windows Agent 26.09 for detailed upgrade guidance, product scope, and verification steps.
rsyslog Windows Agent 26.09 Technical Release Notes
Release date: September 1, 2026
Service build: 26.9.0.353
Configuration Client build: 26.9.0.442
User Interface build: 26.9.0.1017
Upgrade assessment
Recommendation: Recommended update
Why update now: This release corrects service-stop handling during configuration reload, startup of custom-named Windows services, and a timestamp-conversion crash. It also improves administration through the User Interface metrics dashboard.
If you defer: Installations retain the service-operation and timestamp-conversion limitations addressed by this release, as well as the earlier User Interface administration behaviour.
Who benefits most: Administrators who reload configuration, use custom Windows service names, or use the User Interface metrics dashboard.
Upgrade and verification: Update using the normal supported path. Confirm service build 26.9.0.353, reload configuration in a controlled maintenance window, verify a custom service name where used, and reload the User Interface dashboard after Metrics Helper setup.
Important changes
Service operation and reliability
- Change: Stop requests are retained during configuration reload, and services with custom Windows service names start reliably.
- Operational impact: Reduces avoidable disruption during service administration and maintenance.
- Applies to: rsyslog Windows Agent installations that reload configuration or use custom service names.
- Verification: Reload configuration and, where applicable, stop/start the custom-named service during a controlled maintenance window.
Timestamp conversion reliability
- Change: A crash while converting certain read-only timestamp properties is corrected.
- Operational impact: Improves reliability for configurations that process these timestamp properties.
- Applies to: rsyslog Windows Agent configurations using the affected timestamp conversion path.
- Verification: Process a representative test message that uses the relevant timestamp property.
Configuration Client and User Interface
- After local Metrics Helper setup, standard users can reload the User Interface metrics dashboard.
- Service-owned older General settings no longer produce unnecessary unknown-configuration indications.
Published errata and known issues
Installer-update reliability: ERR-2026-002: rsyslog Windows Agent update reports success but program files are not upgraded correctly is resolved in the 26.09 setup release. After a direct upgrade from an earlier product generation, confirm that the installed service reports 26.9.0.353 and that the Configuration Client and the required features are present.
Related links
rsyslog Windows Agent 26.08: Monthly Patch + Feature Drop
rsyslog Windows Agent 26.08 is available now. This monthly Patch + Feature Drop gives Windows log-forwarding teams a clearer view of selected messages, more flexible file monitoring in supported editions, and maintenance improvements for dependable event collection and forwarding.
Faster insight into selected messages
Operators can now view a selected set of stored log and event messages directly in the User Interface. This makes it easier to check what is being processed without leaving the product workflow.
More flexible collection and forwarding
In supported editions, file monitoring can now match files across nested paths with multiple wildcard components, helping teams cover dynamic directory structures with less configuration overhead. 26.08 also improves Event Log monitoring reliability during shutdown and recovery conditions.
Plan your update
The User Interface remains in preview and can be used in production with appropriate care and validation for the individual environment. The Configuration Client remains fully supported.
We recommend keeping rsyslog Windows Agent on the latest Patch + Feature Drop to benefit from current maintenance and product improvements. Consult the rsyslog Windows Agent documentation, then download rsyslog Windows Agent.
Rsyslog Windows Agent 8.4 Released
A new version of the rsyslog Windows Agent is now available. Version 8.4.0 brings native configuration import/export options, improved service stability, and multiple client bug fixes.
Core Service Engine Updates
In the core engine, a critical concurrency fix has been applied to both the Syslog and RELP forwarding actions. The update resolves shared disk-queue rewrite race conditions that previously occurred when multiple forwarding actions were configured to use the same queue directory simultaneously, ensuring greater data integrity during high-load forwarding scenarios.
Configuration Client Enhancements
Native YAML Support
The Configuration Client now natively supports importing and exporting YAML configuration files. This functionality is fully aligned with the service runtime loader, streamlining configuration backups and migrations across environments.
Reliability & Configuration Handling
Registry-based configuration loading has been hardened to handle fresh installations and incomplete registry data smoothly. Additionally, when encountering unknown configuration blocks—such as those introduced by newer service versions—the client now gracefully skips them with a clear warning rather than failing to load.
Service Management & Stability
Service control logic has been overhauled to handle edge cases such as orphan processes, access control issues, and transitional service states. Administrators now have access to optional process termination options and a direct shortcut to Windows Services.
Timeout messaging during start and stop operations has been clarified for cases where the client stops waiting before Windows completes the service transition. The status bar now explicitly tracks states like Stopping, Starting, and Paused (Reloading), and false stop-timeout errors—where the service had already reached a stopped state—have been eliminated.
Additionally, the Event Viewer now prepends new events following start, stop, restart, or reload actions rather than clearing the existing list, while background threading has been improved to recover cleanly from aborted operations. A client crash on shutdown involving open Event Viewer or Service Management panels has also been resolved.
Released versions
- Service: 8.4.0.239
- Client: 8.4.0.334
Rsyslog Windows Agent 8.3 Released
We have just released Rsyslog Windows Agent 8.3, bringing enhanced interoperability, modern configuration options, and deep operational visibility to our professional Windows-to-Linux logging bridge.
A major highlight of this release is the introduction of YAML configuration support. By adding file-based YAML support for service configuration files, rsyslog Windows Agent now allows administrators to utilize human-readable, industry-standard formatting for their configuration logic. This facilitates easier integration with DevOps toolchains and simplifies the management of complex forwarding rules across diverse Windows environments.
Operational transparency has also been significantly improved with the addition of Runtime Metrics. Administrators can now enable a dedicated HTTPS query endpoint to access real-time service metrics. This feature allows for the direct monitoring of event throughput and service health, making it simple to pull performance data into centralized monitoring systems.
Furthermore, rsyslog Windows Agent 8.3 is ready for the next generation of infrastructure with enhanced Windows Server 2025 support, including improved message fallback and custom-channel cleanup within the Event Monitor service.
Continue reading “Rsyslog Windows Agent 8.3 Released”Rsyslog Windows Agent 8.2 Released
A new version of the rsyslog Windows Agent is now available, version 8.2. This update delivers targeted stability improvements, performance optimizations for high-throughput environments, and enhanced compatibility with modern Windows operating systems.
Core Service & Engine Enhancements
High-Load Connection & Performance Optimizations
This release significantly improves the agent’s resilience under heavy traffic. Incoming TCP connections now benefit from an increased listen backlog and more reliable handling during connection spikes. Furthermore, timestamp processing across log messages is more reliable, backed by faster parsing for common log timestamp formats. Rule search expression evaluation has also been optimized for greater speed, accompanied by updated documentation.
Stability & Message Handling
Filter rule evaluation has been stabilized to resolve edge-case issues during message processing. Output formatting logic has been refined to ensure predictable message content preparation prior to forwarding or storage. In addition, character set conversions are now clearer and more consistent across operations.
Operating System Compatibility & Diagnostics
Configuration validation has been tightened to ensure reliable loading of configuration version details. Windows Event Log handling has been updated to ensure event category names render correctly on modern operating systems, including Windows 11 and Windows Server 2025. Finally, diagnostic and debug error messages now display correctly across all supported languages and character encodings.
Download
The new release is available for immediate download through the official page:
RSyslog Windows Agent 8.1 Released
Release Date: 2025-07-16
Build-IDs: Service 8.1.0.232, Client 8.1.0.321
RSyslog Windows Agent 8.1 Released
Adiscon is pleased to announce the release of Rsyslog Windows Agent 8.1.
This release brings significant improvements to the platform’s reliability and functionality. The Mail Action has been modernized with improved SMTP logic and better error handling for email delivery.
Key security and stability improvements include fixes for memory leaks in the REGEX Filter and file compression systems, as well as enhanced timestamp processing to prevent conversion errors. Event Log monitoring now supports microseconds precision for improved compliance with RFC standards.
Detailed information can be found in the version history.
RSyslog Windows Agent 8.0 Released
Adiscon is pleased to announce the release of Rsyslog Windows Agent 8.0.0 Build 230.
This update focuses on enhancing functionality and modernizing the platform. It introduces DTLS Action support, enabling secure logging over UDP, and adds microseconds to timestamps, improving RFC5424 compliance. The OpenSSL library has been upgraded, ensuring compatibility with the latest security protocols, including TLS v1.3.
For greater flexibility, RELP Action now supports custom output encoding.
Detailed information can be found in the version history.
RSyslog Windows Agent 7.5c Released
Adiscon is pleased to announce the release of Rsyslog Windows Agent 7.5c Build 228.
This update enhances the stability and performance of our log processing services. Key improvements include a fix for a memory leak in RFC5424 Syslog Header processing.
Detailed information can be found in the version history.