rsyslog

The rocket-fast system for log processing

News

rsyslog error reporting improved

By jgerhardsPosted on Posted in News, Top NewsTagged ,

Rsyslog provides many up-to-the point error messages for config file and operational problems. These immensly helps when troubleshooting issues. Unfortunately, many users never see them. The prime reason is that most distros do never log syslog.* messages and so they are just throw away and invisible to the user. While we have been trying to make distros change their defaults, this has not been very successful. The result is a lot of user frustration and fruitless support work for the community — many things can very simple be resolved if only the error message is seen and acted on.

We have now changed our approach to this. Starting with v8.21, rsyslog now by default logs its messages via the syslog API instead of processing them internally. This is a big plus especially on systems running systemd journal: messages from rsyslogd will now show up when giving

$ systemctl status rsyslog.service

This is the place where nowadays error messages are expected and this is definitely a place where the typical administrator will see them. So while this change causes the need for some config adjustment on few exotic installations (more below), we expect this to be something that will generally improve the rsyslog user experience.

Along the same lines, we will also work on some better error reporting especially for TLS and queue-related issues, which turn out high in rsyslog suport discussions.

Some fine details on the change of behaviour:

Note: you can usually skip reading the rest of this post if you run only a single instance of rsyslog and do so with more or less default configuration.

The new behaviour was actually available for longer, It needed to be explicitly turned on in rsyslog.conf via

global(processInternalMessages="off")

Of course, distros didn’t do that by default. Also, it required rsyslog to be build with liblogging-stdlog, what many distros do not do. While our intent when we introduced this capability was to provide the better error logging we now have, it simply did not turn out in practice. The original approach was that it was less intrusive. The new method uses the native syslog() API if liblogging-stdlog is not available, so the setting always works (we even consider moving away from liblogging-stdlog, as we see this wasn’t really adopted). In essence, we have primarily changed the default setting for the “processInternalMessages” parameter. This means that by default, internal messages are no longer logged via the internal bridge to rsyslog but via the syslog() API call [either directly or
via liblogging). For the typical single-rsyslogd-instance installation this is mostly unnoticable (except for some additional latency). If multiple instances are run, only the “main” (the one processing system log messages) will see all messages. To return to the old behaviour, do either of those two:

  1. add in rsyslog.conf:
    global(processInternalMessages="on")
  2. export the environment variable RSYSLOG_DFLT_LOG_INTERNAL=1
    This will set a new default – the value can still be overwritten via rsyslog.conf (method 1). Note that the environment variable must be set in your startup script (which one is depending on your init system or systemd configuration).

Note that in most cases even in multiple-instance-setups rsyslog error messages were thrown away. So even in this case the behaviour is superior to the previous state – at least errors are now properly being recorded. This also means that even in multiple-instance-setups it often makes sense to keep the new default!

rsyslog 8.20.0 (v8-stable) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , , , ,

We have released rsyslog 8.20.0.

This release brings a few new additions and requirements. Omrelp now has a configurable connection timeout and pmrfc3164 has a new option to allow slashes in the hostname. Apart from that, there is quite a set of bugfixes.

Please note, to use rsyslog 8.20.0 it is required to update librelp to version 1.2.12.

To get a full overview over the changes, please take a look at the Changelog.
ChangeLog:

libfastjson 0.99.3 released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged ,

We have released libfastjson 0.99.3.

This is a new fork of the json-c library, which is optimized for liblognorm processing.

The changes are mostly for cleanup purposes. Also some bug have been fixed, like a potential segfault issue, “make distcheck” not working and more.

Changelog:

0.99.3 2016-07-11
– new dependency: autoconf-archive
– exit() is no longer called in unexpected situations
The previous code called exit on some occasions and did not
give the caller a chance to do any cleanup or handling on
it’s own. This has completely been removed. Note that it was
very unlikely that this problem affected a caller, as exit()
was only called under very rare circumstances (e.g. OOM).
– fjson_version now returns configure VERSION
This avoid inconsistency.
– removal of Windows and Android bits
Thanks to Michael Biebl for the patch.
– fixes of the build system
Thanks to Michael Biebl for the patch.
– dropped support for Windows and Android as we do not target
these platforms
– “make distcheck” now works
– fix invalid Unicode representation for some non US-ASCII
characters when printed as string. Note that this could
potentially also lead to a segfault

Download:

http://download.rsyslog.com/libfastjson/libfastjson-0.99.3.tar.gz

sha256sum: be5604a9f61b3b247b45bc6234e8bfb5da5dd1e405d07fb8e52b1ea6e2a27fee

As always, feedback is appreciated.

Best regards,
Florian Riedl

rsyslog 8.19.0 (v8-stable) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , , , ,

We have released rsyslog 8.19.0.

This is mostly a bug-fixing release. Among the big number of fixes are a few additions to the testbench and some minor enhancements for several modules (like imrelp, omelasticsearch) to provide more convenience.

To get a full overview over the changes, please take a look at the Changelog.
ChangeLog:

rsyslog 8.18.0 (v8-stable) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , , , , , , , ,

We have released rsyslog 8.18.0.

This is mostly a bug-fixing release. Among the big number of fixes are a few additions to the testbench and some minor enhancements for several modules (like redis, omkafka, imfile) to provide more convenience.

To get a full overview over the changes, please take a look at the Changelog.
ChangeLog:

RSyslog Windows Agent 3.2 Released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , , , ,

Adiscon is proud to announce the 3.2 release of RSyslog Windows Agent.

This is a maintenenance release for RSyslog Windows Agent, which includes Features and bugfixes.

There is a huge list of changes, but the most important is the enhanced support for file based configurations.

Also inbuild components like OpenSSL and NetSNMP have been updated to the latest versions.

Detailed information can be found in the version history below.

Build-IDs: Service 3.2.143, Client 3.2.0.230

Features

  • Components:
    • Updated OpenSSL 1.0.2e.
  • Engine:
    • When using TLS Mode x509/Name, permitted peers will also checked against the certificate Subject Alternative Name (SAN) now.
  • EventLog Monitor V2:
    • Added new Option “Wait time after action failure” which specifies the wait time after an action error occurred. Without the wait time, the subscription would immediately hit again. It is most likely that the action failure was caused by network problems, so a wait time of (default value) 15 seconds is a reasonable default.
  • File Monitor:
    • Added regular expressions support for Message Separators. Also added Options to prepend or append message separators to the message. When using regex message separators, it might be necessary to include the message separator into the message.
  • Syslog Action:
    • Added wait time doubling option for the Diskqueue feature. When enabled, the configured wait time will be doubled until the doubling limit is reached.
    • Added random wait time delay option for the Diskqueue feature. When enabled, a random wait time (up to the configured maximum) will be added to the configured wait time.
    • Added Overrun prevention delay option for the Diskqueue feature. When enabled, the action will sleep for the configured delay between each syslog message.
  • Services TestMode:
    • Added a testmode for Services, currently EventLog Monitor V1 & V2 and File Monitor are supported. When enabling the testmode for a certain service, it will process it’s Events/Files over and over again. So only use this setting for testing purpose.
  • File Based Configuration:
    • Added support for file includes. The feature can be enabled by setting one or both options in the Client Options called “Create individual configuration files for Services” and “Create individual configuration files for RuleSets”. When enabled, the configuration client will split Services and/or Rulesets into separated files. The main configuration file will include these files by a pattern. The Service itself is able to read includes within includes up to a depth level to 10. When using custom (hand written) configuration with includes, the configuration client will only be able to read them. However the client will not be able to maintain (Save) the custom configuration structure.
  • Command line:
    • Added handler for CTRL+C when running the Service in console mode

Bugfixes

  • Syslog Server:
    • Fixed a problem receiving RFC3195RAW messages.
    • Fixed message timeout handling when no message separator was enabled in Syslog TCP mode.
  • Syslog Action:
    • Fixed an issue when diskqueue files were corrupt. Now corrupted entries are skipped properly.
    • In some cases when the Action was in diskqueue mode, it could happen that the internal retry failed. Cached syslog messages wouldn’t be sent until the service restart.
  • SSL/TLS:
    • Actions with support for SSL/TLS (like Send Syslog Action) could fail to send messages if the recipient closed the connection during meantime. The handling of closed connections has been hardened now when TLS/SSL is enabled.
  • Command line:
    • Fixed handling when using more than one command line option
  • File Based Configuration:
    • Fixed a bug reading general options from File configuration.
    • Fixed an issue reading and writing into correct data directories when using custom locations.
    • Fixed an issue detecting if data state files need to be reloaded.
    • Better error handling when configfile is missing or not accessible.
  • Configuration client:
    • When deleting an item in a datagrid, the Confirm/reset Button become clickable now to save or reset the changes.
    • Fixed timestamp for “EventLog Legacy Format” INSERT
    • Fixed invisible encryption checkbox for password fields (Like ODBC Action)
    • Fixed an issue of unwanted LastRecord saving when changing eventlog channels settings.
    • The little “Save” Button has been changed to a “Confirm” which is more precisely.
    • Corrected Min/Max values for General->Queue Limit Setting.
    • Removed invisible click areas for all checkboxes and radio buttons.
    • Fixed loading of “Processed Files” in File Monitor when running in file config format.
    • Changed error handling when exporting configuration in file format.
    • Fixed incorrect trimming of spaces at the end of text variables (problem only affected file based configurations)

Version 3.2 is a free download. Customers with existing 2.x keys can contact our Sales department for upgrade prices. If you have a valid Upgrade Insurance ID, you can request a free new key by sending your Upgrade Insurance ID to sales@adiscon.com. Please note that the download enables the free 30-day trial version if used without a key – so you can right now go ahead and evaluate it.

rsyslog 8.17.0 (v8-stable) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , , , ,

We have released rsyslog 8.17.0.

This release brings, among a few bugfixes, a lot of brand-new features. The most important change is probably the libfastjson requirement, which replaces the json-c dependency. There is a new contributed plugin called omampq1 for AMQP 1.0 compliant brokers, a new experimental lookup table support, dynamic statistics counters and many many more.

To get a full overview over the changes, please take a look at the Changelog.
ChangeLog:

http://www.rsyslog.com/changelog-for-8-17-0-v8-stable/

Download:

http://www.rsyslog.com/downloads/download-v8-stable/

As always, feedback is appreciated.

Best regards,
Florian Riedl

libfastjson 0.99.2 released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged ,

We have released libfastjson 0.99.2.

This is a new fork of the json-c library, which is optimized for liblognorm processing.

The changes consist of a new API and compatibility with autoconf < 2.64.

Changelog:

0.99.2 2016-03-07
– new API: json_object_get_member_count()
– make comaptible with autoconf < 2.64

Download:

http://download.rsyslog.com/libfastjson/libfastjson-0.99.2.tar.gz

sha256sum: 6ff053d455243a81014f37b4d81c746d9b8d40256a56326c3a7921c8bf458dfd

As always, feedback is appreciated.

Best regards,
Florian Riedl

rsyslog 8.16.0 (v8-stable) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , , , , ,

We have released rsyslog 8.16.0.

This release is mostly a bugfixing release with fixes for impstats, omelasticsearch, imfile, ommail and many more. The biggest change however is the addition of the extraction support in rsgtutil for ksi support (https://github.com/rsyslog/rsyslog/issues/561).

To get a full overview over the changes, please take a look at the Changelog.
ChangeLog:

http://www.rsyslog.com/changelog-for-8-16-0-v8-stable/

Download:

http://www.rsyslog.com/downloads/download-v8-stable/

As always, feedback is appreciated.

Best regards,
Florian Riedl

libfastjson 0.99.0 released

By Adiscon SupportPosted on Posted in Release AnnouncementTagged , ,

We have released libfastjson 0.99.0.

This is a new fork of the json-c library, which is optimized for liblognorm processing.

More details are available here: rsyslog and liblognorm will switch to libfastjson as replacement for json-c

Changelog:

0.99.0 2015-12-22
– bugfix: reference counting was not thread-safe

Download:

http://download.rsyslog.com/libfastjson/libfastjson-0.99.0.tar.gz

sha256sum: 5d19c39daaedfd9b335f6222b521e7529016bc11382cccebe41a9894d4ab32fd

As always, feedback is appreciated.

Best regards,
Florian Riedl

Scroll to top