We have just released rsyslog 6.1.2, the new v6-devel.
This release has as first release the experimental support for log normalization (via liblognorm).
Support for normalizing log messages has been added in the form of mmnormalize. The core engine (property replacer, filter engine) has been enhanced to support properties from normalized events.
Note: this is EXPERIMENTAL code. It is currently known that there are issues if the functionality is used with
- disk-based queues
- asynchronous action queues
You can not use the new functionality together with these features.
This limitation will be removed in later releases. However, we preferred to release early, so that one can experiment with the new feature set and accepted the price that this means the full set of functionality is not yet available. If not used together with these features, log normalizing should be pretty stable.
We have written a small guide that should help you with setting up the new version and gives a introduction to the mmnormalize feature. You can find it here: http://www.rsyslog.com/normalizer-first-steps-for-mmnormalize/
Again, this new feature is EXPERIMENTAL!
Additionaly, this release brings some enhancements for the testing tool tcpflood. It now supports sending via UDP, has the capability to run multiple iterations and generate statistic data records.
As always, feedback is appreciated.