rsyslog 8.2606.0: stream compression, Elastic Beats input, and ongoing defensive hardening

We have released rsyslog 8.2606.0, the June 2026 scheduled-stable version. Scheduled-stable releases are bi-monthly snapshots of the daily-stable branch, providing predictable update points with the same functional content as daily-stable at the time of the snapshot.

The main theme of this release is operational robustness under pressure: reducing forwarding bandwidth with experimental stream compression, adding Elastic Beats input support for selected pipeline use cases, and continuing the defensive hardening work across the code base.

The three changes that deserve the most attention are:

• Experimental TCP stream compression for omfwd to imtcp
• New Elastic Beats / Lumberjack input module via imbeats
• Continued defensive hardening and reliability work

Experimental stream compression for high-volume forwarding

The biggest new feature in 8.2606.0 is experimental stream compression for TCP forwarding from omfwd to imtcp.

This is aimed at environments where rsyslog moves large volumes of log data across constrained, expensive, or operationally sensitive network links. Compressing the forwarding stream can reduce bandwidth consumption, support FINOPS goals, and improve robustness during traffic spikes.

That matters especially during incidents or attack periods, when log volume can rise sharply at exactly the moment when infrastructure is already under stress. Preserving bandwidth helps keep the logging pipeline useful when it is needed most.

omfwd can now send compressed TCP streams with compression.mode="stream:always", and imtcp can decompress matching streams with zlib or zstd drivers on both sides. Receiver-side guardrails cover expansion and per-receive decompression limits, and the feature includes impstats coverage, documentation, and tests.

This is rsyslog stream compression, not TLS-native compression. It can be layered with TLS, but it should still be treated as experimental in 8.2606.0. Sender and receiver compression driver choices must match.

imptcp also gained a stream:auto mode, allowing one listener to accept both zlib-compressed and plain sessions. This can help staged deployments where not all forwarding clients switch at once.

Elastic Beats input via imbeats

8.2606.0 also adds imbeats, a new input module for Elastic Beats and Elastic Agent output.logstash traffic via Lumberjack v2.

This has a smaller target audience than generic syslog forwarding, but it is important for sites that want to place rsyslog inside Elastic-style pipelines for performance, routing flexibility, enrichment, filtering, or to avoid total vendor lock-in.

imbeats accepts JSON event frames, compressed frames, and cumulative acknowledgements over TCP or TLS. It preserves the original JSON payload, maps decoded fields into $!, and stores transport metadata under $!metadata!imbeats. It also includes practical limits for frame, batch, window, decompressed payload, and session sizes.

Defensive hardening in a changing threat landscape

A large part of this release continues rsyslog’s defensive hardening work. Some of this comes from automated analysis, some from manual review, and some from normal issue-driven maintenance. It is a continuous effort.

As automated exploitation and AI-assisted bug discovery become more common, rsyslog continues to tighten parser boundaries, input handling, cleanup paths, queue behavior, diagnostics, and test oracles.

Examples in this release include stricter mmjsonparse boundary handling, safer treatment of embedded NUL bytes at C-string helper boundaries, improved safe disk queue recovery accounting, re-enqueueing of interrupted transactional action queue batches during shutdown, and additional hardening in imdocker, imtcp, imptcp, TLS drivers, parser paths, template handling, and runtime message replacement.

Selected additional improvements

The release also contains a broad set of operational and configuration improvements:

• imfifo adds line-oriented POSIX FIFO input support.
• imfile improves same-file monitor handling, deleted-file cleanup, and optional per-file line_number metadata.
• imkafka supports multiple topics in one input instance.
• imjournal improves diagnostics and recovery for future-dated or invalidated journal entries.
• omfwd, omhttp, omkafka, ommysql, ompgsql, and omclickhouse received reliability and diagnostic fixes.
• RainerScript adds cbool(), tocef(), cef_ext_escape(), and parse_time_localtz().
• Configuration diagnostics now catch more common mistakes, including constant boolean operands and duplicate action or dynstats bucket names.
• TLS, AIX portability, cross-build handling, CI coverage, and local validation tooling were improved.

Compatibility notes

• libyaml support is now an explicit configure feature. It remains enabled by default and must be satisfied by package builds unless --disable-libyaml is passed. This removes the previous auto-detection behavior where the presence or absence of libyaml development files silently changed the feature set.
• TCP stream compression is experimental in this release. It is rsyslog stream compression, not TLS-native compression. zlib/zstd driver choices must match across sender and receiver.
• parser.dropTrailingCROnReception defaults to off, preserving existing CR handling unless explicitly enabled.
• Duplicate action names and dynstats bucket names remain valid for compatibility, but now produce diagnostics.
• Configurations that accidentally relied on negated exact priority filters such as local4.!=debug matching nothing may now see the documented messages.
• RainerScript boolean expressions with constant operands now produce parser warnings. Existing syntax and truthiness behavior are unchanged.
• omelasticsearch now warns when the legacy searchType parameter is configured, because Elasticsearch mapping types are obsolete.
• omrelp keeps its default TLS authentication failure behavior. The new suspend-on-auth-failure behavior is opt-in via tls.permanentFailureDisablesAction="off".

Availability

The rsyslog 8.2606.0 source release is available from the usual rsyslog download locations. Packages and container images may appear with some delay while downstream publishing completes.

Thank you

We thank all contributors who made this release possible. External contributions credited in this cycle include work from 0xseiryuu, Attila Lakatos, Billie Alsup, Jacob, Julien Thomas, Juliusz Sosinowicz, Jeremie Jourdin, Midnya, shinigami35, Tamir Suliman, and Yury Bushmelev. All other changes were contributed by Adiscon GmbH.