rsyslog

High-performance log ingestion and ETL engine

rsyslog

High-performance log ingestion and ETL engine

rulesets and rsyslog 7.2+

Adiscon SupportFAQ, ,

In rsyslog 7.2.0 we introduced some interesting config enhancements. Among these are changes to how rulesets can be specified or called. A ruleset is basically looking like this:

ruleset(name="rulesetname") { statements here }

As you can see, you specify a ruleset by its name. All statements that will be specified go into the curly brackets. In addition, a ruleset can be called by another ruleset. This is simply done by call rulesetname The rulesetname is just plainly specified. We hope this to be more intuitively. Here is a larger example (bascially taken from the rsyslog mailing list, thanks to Brian Knox). module(load="imptcp" keepalive="on") # use imptcp just as example for bind ruleset below ruleset(name="rs1") { *.* /var/log/test1.log } ruleset(name="rs2") { *.* /var/log/test2.log call rs1 } input(type="imptcp" port="13514" ruleset="rs2") All statements, which are NOT specified in a ruleset will be automatically inserted into the default ruleset.

Legacy $Ruleset statements are still supported, but cannot be cross-used with the new ruleset() statements.

rsyslog 7.3.2 (v7-devel) released

adisconteamNews, Release Announcement, , , , , , , ,

This release introduced a totally new rate-limiting system for all modules as well as much better “last message repeated n times” handling. For details, please see Rainer’s blog at

http://blog.gerhards.net/2012/10/rate-limiting-in-rsyslog-732.html

Besides this feature, the version also includes enhancements for omelasticsearch as well as input batching support for imudp (which should provide some performance boost on very busy systems). Also, action-like statements (call, stop, …) are now supported in action lists. Of course, there are also some bugfixes, many imported from v6 and v7.2.

ChangeLog:

http://www.rsyslog.com/changelog-for-7-3-2-v7-devel/

Download:

http://www.rsyslog.com/rsyslog-7-3-2-v7-devel/

As always, feedback is appreciated.

Best regards,
Tim Eifler

Changelog for 7.3.2 (v7-devel)

adisconteamChangelog, , , , , , , , ,

Version 7.3.2 [devel] 2012-10-30

  • totally reworked ratelimiting and “last message repeated n times”
    all over rsyslog code. Each of the supported inputs now supports
    linux-like ratelimiting (formerly only imuxsock did). Also, the
    “last message repeated n times” is now processed at the input side
    and no longer at the output side of rsyslog processing. This
    provides the basis for new future additions as well as usually more
    performance and a much simpler output part (which can be even further
    refactored).
  • imtcp: support for Linux-Type ratelimiting added
  • imptcp: support for Linux-Type ratelimiting added
  • imudp enhancements:
    • support for input batching added (performance improvement)
    • support for Linux-Type ratelimiting added
  • permited action-like statements (stop, call, …) in action lists
  • bugfix: segfault on startup when modules using MSG_PASSING mode are used
  • omelasticsearch: support for writing data errors to local file added
  • omelasticsearch: fix check for bulk processing status response

Changelog for 7.2.1 (v7-stable)

adisconteamChangelog, , , , , , ,

Version 7.2.1  [v7-stable] 2012-10-29

  • bugfix: ruleset()-object did only support a single statement
  • added -D rsyslogd option to enable config parser debug mode
  • improved syntax error messages by outputting the error token
  • the rsyslog core now suspeneds actions after 10 failures in a row
    This was former the case after 1,000 failures and could cause rsyslog
    to be spammed/ressources misused. See the v6 compatibility doc for more details.
  • ommongodb rate-limits error messages to prevent spamming the syslog
    closes (for v7.2): http://bugzilla.adiscon.com/show_bug.cgi?id=366

Quick guide to omzmq3

Adiscon SupportFAQ, , ,

Here is a quick guide for using rsyslog with omzmq3. The mentioned procedure has been tested with rsyslog 7.1.12. In future versions, this could be different.

1. Build zeromq 3.2.1-rc2

2. Build czmq 1.2.0, linking it with zeromq 3.2.1-rc2

3. Build rsyslog 7.1.12, using the “–enable-omzmq3” configure option

4. Configured rsyslog to publish all messages on a zmq bind socket:

*.* action(type="omzmq3" sockType="PUB" action="BIND" description="tcp://*:11514" template="any_message_template")

DON’T FORGET THE TEMPLATE: Otherwise, rsyslog will segfault.

 

Special Thanks go to Philippe Muller for providing this information

How to use rsyslog v7 on debian 5?

Adiscon SupportFAQ, , ,

As development continues, there sometimes arises the need for additional packages to be installed in order to run the newest version. It is the same case for rsyslog. Since version 6.6.0 there is a requirement for json-c to be installed. For debian 6, there are packages available via package managers for easy installation. So there is no problem. For debian 5, the package repositories are unavailable and there is no .deb for json-c delivered on the disc. But without json-c, there is no chance to even install a current rsyslog on debian 5.

Gladly, there are other means to install json-c. There are tarballs available at

https://github.com/json-c/json-c/downloads

Unpack the tarball and install it with:

./configure --prefix=/usr
make
make install

Unfortunately, make install seems not to copy all the necessary files to correct destination. You still have to manually copy a single file. Do the following:

cp some/directory/json-c-0.10/json_object_iterator.h /usr/include/json/

Now you are all set up to install rsyslog 6.6.0 or 7.2.0 on a debian 5 system. If other packages are still missing (like bison), they are available as package on the disc.

Scroll to top