rsyslog 8.2608.0 Released

We are pleased to announce the release of rsyslog 8.2608.0. This release packs a massive wave of improvements, introducing native Kubernetes log tailing, a new AWS CloudWatch Logs output module, modernized storage engine features, and substantial defensive hardening across core protocols and inputs.

Below is a detailed breakdown of what’s new and improved in this cycle.

Key Highlights & Major Features

• Native Kubernetes Log Input (imkubernetes) A brand-new input module that directly tails container and pod log files from the host filesystem. It seamlessly parses CRI and Docker json-file formats, handles CRI partial-record reassembly, and enriches log events with Kubernetes API metadata.
• AWS CloudWatch Logs HLC Output (omawslogshlc) Introduces native support for streaming logs directly to Amazon CloudWatch via the HTTP Log Collector (HLC) endpoint using bearer-token authentication. Events are efficiently batched per transaction using standard rsyslog action retry paths.
• Segmented Disk Queues & Maintenance Utility Disk-assisted queues (FixedArray and LinkedList) now leverage the segmented disk engine by default for new stores while safely maintaining existing classic backlogs. Alongside this update, a new segmented queue maintenance utility is now packaged to inspect stores, export lossless JSONL, and perform offline queue repairs.
• Performance: mmnormalize TurboVM Acceleration When compiled against liblognorm 2.1.0+ with TurboVM enabled, mmnormalize now supports accelerated worker normalization (turbo="on") and lazy JSON materialization for significantly higher throughput.
• Modernized Network ACLs (allowedSender) Both imtcp and imudp now support modern array-based allowedSender directives at both module and input scopes, giving operators flexible IP-filtering without relying on legacy configuration constructs.

Security, Hardening & Defensive Enhancements

• Dynamic File Path Containment (omfile): By default, dynaFile paths derived from message content are now lexically contained within their configured base directory to prevent path traversal issues.
• Symlink Controls (omfile & Disk Queues): omfile adds a followSymlinks control managed by the secure compatibility policy, while disk queue spools now explicitly reject final-component symlinks.
• TLS URI & Security Upgrades (omfwd, omelasticsearch): omfwd/ossl supports pkcs11: URIs with automatic log sanitization for sensitive PIN attributes. omelasticsearch gains modern TLS controls (tls.tlsversion, tls.ciphersuites, tls.keyexchangegroups), including post-quantum cryptography (PQC) hybrid key exchanges.
• Input Resource Guardrails:
  • imbeats: Added resource and protocol guardrails (memory accounting, compressed payload bounds, receive deadlines) and fixed a issue where failed TLS handshakes could leave listeners disarmed.
  • imhttp / imptcp: Added body size checks after gzip decompression and tightened regex-framing recovery to prevent negative length calculation errors.
  • impcap: Added explicit bounds checks on ARP/RARP packet address lengths.

Kubernetes & Cloud Infrastructure Refinements

• mmkubernetes Enhancements:
  • Added Kubernetes API URL failover across multiple endpoints using array syntax.
  • Dynamic ServiceAccount token refreshing at configurable intervals (with 401 retries) to support automatic token rotation without daemon restarts.
  • Opt-in/opt-out namespace metadata via includeNamespaceMetadata to reduce memory and lookup overhead when pod enrichment is sufficient.
• Opt-in systemd READY Delay: The new systemd.notifyReadyDelay="on" setting allows rsyslog to delay signaling READY=1 to systemd until opt-in inputs (like imfile) finish loading state files and setup work.

Engine, Scripting & Stability Fixes

• RainerScript String Escaping: Modernized string parsing to accept standard \xhh hexadecimal escapes uniformly across all expression, procedure, and object parameters.
• Core Crash Guard: msgSetPropViaJSON() now safely ignores JSON null values instead of dereferencing null pointers, fixing edge-case crashes triggered via mmexternal, mmlua, or pmnormalize.
• Sub-Second Delay Fix (imfile): Corrected byte/time order handling in delay.message, ensuring millisecond values (e.g., 1000) delay for 1ms rather than 1000 seconds.
• Journal CPU Loop Prevention (imjournal): Resolved an issue where journal rotations or invalidations caused a high-CPU busy loop during handle recovery.
• Disabled Actions Optimization: Actions marked with config.enabled="off" no longer instantiate sub-modules or execute setup side effects.

Availability

The rsyslog 8.2606.0 source release is available from the usual rsyslog download locations. Packages and container images may appear with some delay while downstream publishing completes.

Thank you

As always, a huge thank you to all contributors, developers, and users who submitted bug reports, code updates, and feature requests for this release!