rsyslog

High-performance log ingestion and ETL engine

rsyslog

High-performance log ingestion and ETL engine

Quick guide to omzmq3

Adiscon SupportFAQ, , ,

Here is a quick guide for using rsyslog with omzmq3. The mentioned procedure has been tested with rsyslog 7.1.12. In future versions, this could be different.

1. Build zeromq 3.2.1-rc2

2. Build czmq 1.2.0, linking it with zeromq 3.2.1-rc2

3. Build rsyslog 7.1.12, using the “–enable-omzmq3” configure option

4. Configured rsyslog to publish all messages on a zmq bind socket:

*.* action(type="omzmq3" sockType="PUB" action="BIND" description="tcp://*:11514" template="any_message_template")

DON’T FORGET THE TEMPLATE: Otherwise, rsyslog will segfault.

 

Special Thanks go to Philippe Muller for providing this information

How to use rsyslog v7 on debian 5?

Adiscon SupportFAQ, , ,

As development continues, there sometimes arises the need for additional packages to be installed in order to run the newest version. It is the same case for rsyslog. Since version 6.6.0 there is a requirement for json-c to be installed. For debian 6, there are packages available via package managers for easy installation. So there is no problem. For debian 5, the package repositories are unavailable and there is no .deb for json-c delivered on the disc. But without json-c, there is no chance to even install a current rsyslog on debian 5.

Gladly, there are other means to install json-c. There are tarballs available at

https://github.com/json-c/json-c/downloads

Unpack the tarball and install it with:

./configure --prefix=/usr
make
make install

Unfortunately, make install seems not to copy all the necessary files to correct destination. You still have to manually copy a single file. Do the following:

cp some/directory/json-c-0.10/json_object_iterator.h /usr/include/json/

Now you are all set up to install rsyslog 6.6.0 or 7.2.0 on a debian 5 system. If other packages are still missing (like bison), they are available as package on the disc.

rsyslog 7.2.0 (v7-stable) released

Adiscon SupportNews, Release Announcement, , , , ,

We are proud to announce the first stable version of the v7 branch. It contains only minor bug fixes in addition to the latest beta.

With that version, a full structured-logging/lumberjack enabled version is now available. For the top 5 advantages of rsyslog v7, please see

http://www.rsyslog.com/main-advantages-of-rsyslog-v7-vs-v5/

With this release, version 5 of rsyslog becomes legacy and is no longer supported by the rsyslog project. However, rsyslog v5 continues to be supported as part of Adiscon’s professional services for rsyslog, please see

http://www.rsyslog.com/professional-services/enterprise-support/

We would also like to point you to Rainer’s blog, where he describes the importance of this release in more detail. The relationship to v6 is also clarified. Please see

http://blog.gerhards.net/2012/10/new-v7v6-stable-v5-now-legacy.html

 

ChangeLog:

http://www.rsyslog.com/changelog-for-7-2-0-v7-stable/

Download:

http://www.rsyslog.com/rsyslog-7-2-0-v7-stable/

As always, feedback is appreciated.

Best regards,
Florian Riedl

rsyslog 7.3.1 (v7-devel) released

Adiscon SupportNews, Release Announcement, , , , , , ,

We have just released 7.3.1 of the v7-devel branch. This version increases template processing speed, for the $NOW-family of properties very considerably. It also contains a compatibility change in regard to lumberjack structured logging.

ChangeLog:

http://www.rsyslog.com/changelog-for-7-3-1-v7-devel/

Download:

http://www.rsyslog.com/rsyslog-7-3-1-v7-devel/

As always, feedback is appreciated.

Best regards,
Florian Riedl

Changelog for 7.3.1 (v7-devel)

Adiscon SupportChangelog, , , , , , ,

Version 7.3.1  [devel] 2012-10-19

  • optimized template processing performance, especially for $NOW family of properties
  • change lumberjack cookie to “@cee:” from “@cee: ”
    CEE originally specified the cookie with SP, whereas other lumberjack tools used it without space. In order to keep interop with lumberjack, we now use the cookie without space as well. I hope this can be changed in CEE as well when it is released at a later time.
    Thanks to Miloslav Trmač for pointing this out and a similiar v7 patch.
  • bugfix: imuxsock and imklog truncated head of received message
    This happened only under some circumstances. Thanks to Marius
    Tomaschwesky, Florian Piekert and Milan Bartos for their help in solving this issue.
  • bugfix: imuxsock did not properly honor $LocalHostIPIF
Scroll to top