rsyslog 7.5.6 (v7-devel) released

This version contains new features and bug fixes. Most importantly, it contains a new module “mmsequence” (contributed by Pavel Levshin) which permits action load balancing. Also, variable access has been totally refactored and its processing speed improved. Note that this refactoring has some additional bug potential, so watch your system closely after the upgrade. Support for global variables has been removed, as the idea did not work out properly with the current core engine version and resulted in very unintuitive results (most folks would them simply call “wrong”…).
More detailed information is available in the changelog.

ChangeLog: http://www.rsyslog.com/changelog-for-7-5-6-v7-devel/

Download: http://www.rsyslog.com/rsyslog-7-5-6-v7-devel/

As always, feedback is appreciated.

Best regards,

Tim Eifler

Changelog for 7.4.5 (v7-stable)

Version 7.4.5 [v7.4-stable] 2013-10-22

  • mmanon: removed the check for specific “terminator characters” after
    last octet. As it turned out, this didn’t work in practice as there
    was an enormous set of potential terminator chars — so removing
    them was the best thing to do. Note that this may change behaviour of
    existing installations. Yet, we still consider this an important
    bugfix, that should be applied to the stable branch.
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=477
    Thanks to Muri Cicanor for initiating the discussion
  • now requires libestr 0.1.8 as early versions had a nasty bug in
    string comparisons
  • omelasticsearch: add failed.httprequests stats counter
  • bugfix: invalid property filter was not properly disabled in ruleset
    Note that this bugfix introduces a very slight memory leak, which is
    cosmetic, as it just holds data until termination that is no longer
    needed. It is just the part of the config that was invalid. We will
    “fix” this “issue” in the devel version first, as the fix is a bit
    too intrusive to do without hard need in the stable version.
  • bugfix: segfault if re_extract() function was used and no match found
  • bugfix: potential misadressing on startup if property-filter was used
    This could happen if the property name was longer than 127 chars, a case
    that would not happen in practice.
  • bugfix: omelasticsearch: correct failed.http stats counter
  • bugfix: omelasticsearch: did not correctly initialize stats counters
  • bugfix: omelasticsearch: failed.es counter was only maintained in bulk mode
    This usually did not lead to any problems, because they are in static
    memory, which is initialized to zero by the OS when the plugin is
    loaded. But it may cause problems especially on systems that do not
    support atomic instructions – in this case the associated mutexes also
    did not get properly initialized.
  • bugfix: mmanon did not detect all IP addresses in rewrite mode
    The problem occured if two IPs were close to each other and the first one
    was shrunk.
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=485
    Thanks to micah-at-riseup.net for reporting this bug
  • bugfix: mmanon sometimes used invalid replacement char in simple mode
    depending on configuration sequence, the replacement character was set
    to ‘s’ instead of the correct value. Most importantly, it was set to
    ‘s’ if simple mode was selected and no replacement char set.
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=484
    Thanks to micah-at-riseup.net for reporting this bug
  • bugfix: memory leak in mmnormalize
  • bugfix: array-based ==/!= comparisions lead to invalid results
    This was a regression introduced in 7.3.5 bei the PRI optimizer
  • bugfix: omprog blocked signals to executed programs
    The made it impossible to send signals to programs executed via
    omprog.
    Thanks to Risto Vaarandi for the analysis and a patch.
  • bugfix: doc: imuxsock legacy param $SystemLogSocketParseTrusted was
    misspelled
    Thanks to David Lang for alerting us
  • bugfix: imfile “facility” input parameter improperly handled
    caused facility not to be set, and severity to be overwritten with
    the facility value.
    Thanks to forum user dmunny for reporting this bug.
  • bugfix: small memory leak in imfile when $ResetConfigVariables was used
    Thanks to Grégory Nuyttens for reporting this bug and providig a fix
  • bugfix: segfault on startup if TLS was used but no CA cert set
  • bugfix: segfault on startup if TCP TLS was used but no cert or key set
  • bugfix: some more build problems with newer json-c versions
    Thanks to Michael Biebl for mentioning the problem.
  • bugfix: build system: libgcrypt.h needed even if libgrcypt was disabled
    Thanks to Jonny Törnbom for reporting this problem

rsyslog 7.5.5 (v7-devel) released

This release offers some important bug fixes and exciting new features. Most importantly, imudp can now use multiple input threads for even higher UDP input throughput. And imfile now longer has a hardcoded limit on the number of files that can be monitored. You can now monitor as many files as you like. Support for setting default timezones has been added to imptcp and imudp, but is still in experimental state (but feel free to use it if it suits you!). More detailed information is available in the changelog.

ChangeLog: http://www.rsyslog.com/changelog-for-7-5-5-v7-devel/

Download: http://www.rsyslog.com/rsyslog-7-5-5-v7-devel/

As always, feedback is appreciated.

Best regards, Florian Riedl

Changelog for 7.5.5 (v7-devel)

Version 7.5.5 [devel] 2013-10-16

  • imfile: permit to monitor an unlimited number of files
  • imptcp: add “defaultTZ” input parameter
  • imudp: support for multiple receiver threads added
  • imudp: add “dfltTZ” input config parameter
  • bugfix: memory leak in mmnormalize
  • bugfix: mmutf8fix did not properly handle invalid UTF-8 at END of message if the very last character sequence was too long, this was not detected
    Thanks to Risto Vaarandi for reporting this problem.
  • mmanon: removed the check for specific “terminator characters” after  last octet. As it turned out, this didn’t work in practice as there was an enormous set of potential terminator chars — so removing them was the best thing to do. Note that this may change behaviour of existing installations. Yet, we still consider this an important bugfix, that should be applied to the stable branch.
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=477
    Thanks to Muri Cicanor for initiating the discussion
  • now requires libestr 0.1.7 as early versions had a nasty bug in string comparisons
  • bugfix: mmanon did not detect all IP addresses in rewrite mode
    The problem occured if two IPs were close to each other and the first one was shrunk.
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=485
    Thanks to micah-at-riseup.net for reporting this bug
  • bugfix: mmanon sometimes used invalid replacement char in simple mode depending on configuration sequence, the replacement character was set to ‘s’ instead of the correct value. Most importantly, it was set to ‘s’ if simple mode was selected and no replacement char set.
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=484
    Thanks to micah-at-riseup.net for reporting this bug
  • bugfix: memory leak in mmnormalize
  • bugfix: array-based ==/!= comparisions lead to invalid results
    This was a regression introduced in 7.3.5 bei the PRI optimizer

impstats delayed or lost? – cause and cure

Some users report that they do not receive all impstats log records or that these log records are delayed. The common thing about these questions is that those user tend to have very large main message queues.

By default, impstats is run in-band, which means that it’s messages are submitted to the main message queue just like any other messages are.  So if the main queue takes very long to processs, impstats messages get delayed as well. They may be discarded, too, based on queue settings and queue full status. In this scenarios, impstats obviously has problems reporting what is going on.

A simple solution is to run impstats off-band. This is done by simply instructing it to directly write to file. In that mode, the rsyslog engine is not used at all, and output will always be available and happen right on the interval. There is a drawback, though: as the rsyslog core engine is not involved, things like dynafiles, different templates or forwarding to another host are not possible.

Note that impstats can submit messages both to a file and the regular message stream. This may be an interesting alternative if the main queue causes trouble but usually logs shall be gathered at some central place.

Example for writing to a local file:

module(load="impstats" interval="600" severity="7" log.file="/var/log/impstats")

rsyslog 7.5.4 (v7-devel) released

This release offers some interesting features. It provides a new module called mmpstrucdata to parse RFC5424 structured data into json message properties. Also the default queue.size values have been altered to more suitable values. Omfwd and omfile received new parameters and we changed a bigger portion of the documentation to improve usability by linking relevant web ressources to quickly find additional information. Finally, there have been a few other changes and bugfixes.

More detailed information is available in the changelog.

ChangeLog:

http://www.rsyslog.com/changelog-for-7-5-4-v7-devel/

Download:

http://www.rsyslog.com/rsyslog-7-5-4-v7-devel/

As always, feedback is appreciated.

Best regards,
Florian Riedl

Changelog for 7.5.4 (v7-devel)

Version 7.5.4 [devel] 2013-10-07

  • mmpstrucdata: new module to parse RFC5424 structured data into json message properties
  • change main/ruleset queue defaults to be more enterprise-like
    new defaults are queue.size 100,000 max workers 2, worker activation after 40,000 msgs are queued, batch size 256. These settings are much more useful for enterprises and will not hurt low-end systems that much. This is part of our re-focus on enterprise needs.
  • omfwd: new action parameter “maxErrorMessages” added
  • omfile: new module parameters to set action defaults added
    * dirCreateMode
    * fileCreateMode
  • mmutf8fix: new module to fix invalid UTF-8 sequences
  • imuxsock: handle unlimited number of additional listen sockets
  • doc: improve usability by linking to relevant web ressources
    The idea is to enable users to quickly find additional information, samples, HOWTOs and the like on the main site. At the same time, (very) slightly remove memory footprint when few listeners are monitored.
  • bugfix: omfwd parameter streamdrivermmode was not properly handled
    It was always overwritten by whatever value was set via the legacy directive $ActionSendStreamDriverMode
  • imtcp: add streamdriver.name module parameter
    permits overriding the system default stream driver (gtls, ptcp)
  • bugfix: build system: libgcrypt.h needed even if libgrcypt was disabled
    Thanks to Jonny Törnbom for reporting this problem
  • imported bugfixes from 7.4.4
Scroll to top