Rsyslog Windows Agent 26.08 Released
A new version of the Rsyslog Windows Agent is now available. Version 26.08 is a major update that introduces new message querying capabilities, multi-wildcard path monitoring, extensive service engine hardening, and significant feature expansions across both the New User Interface and Legacy Configuration Client.
Core Engine & Service Enhancements
New Features & Path Handling
The core service engine introduces a new Message Ringbuffer action, allowing stored messages to be directly queried through the metrics endpoint. The File Monitor service now supports multi-wildcard paths, enabling directory and filename patterns to be combined across similarly named subfolders.
Additionally, TCP listeners now dynamically request the system-supported maximum connection backlog rather than relying on a fixed queue limit, and direct foreground configuration options have been added so the service can load file or registry settings without using the default installed service path.
Service Hardening & Concurrency Fixes
Engine reliability during shutdowns, reloads, and high-volume operations has been overhauled across multiple modules:
- Diagnostics & Metrics: Resolved configuration-reload crashes near the metrics HTTP endpoint, keeping metrics state process-scoped across reloads to eliminate teardown races.
- File & Event Monitoring: Corrected state keys and parent-directory handling for multi-wildcard paths to prevent unintended ingestion of sibling files. A shared lookup-cache data race under concurrent Event Monitor instances was resolved, and bookmark resets during shutdown are now safely aborted while in error backoff.
- Syslog Server & RELP: Hardened TCP session teardown and buffer management to prevent use-after-free conditions or corruption with large messages. Winsock reference counting was balanced across reloads so RELP sending remains stable after saving.
- Shutdown & Lifecycle Management: Queue handle lifetimes now feature modernized, event-driven bounded termination for cleaner service stops. Cancellable socket readiness races that previously blocked producers were fixed, disk-cache replay for queued outbound work was hardened, and TCP listeners now unblock immediately during shutdown rather than waiting out the full stop window.
- Diagnostics & Event Logs: Event Log entries now feature unique Event IDs, expanded public troubleshooting guidance, and clearer customer-facing TLS failure descriptions and licensing actions.
New User Interface
Live Metrics & Dashboard
The New User Interface introduces a local metrics dashboard complete with live message viewing, provisioning tools, and dedicated support for the new Message Ringbuffer live viewer. It also adds metrics security diagnostics, allows NTLM fallback for managed local metrics access, and recovers smoothly from blocked service restarts during metrics setup.
Feature Additions & Workbench Improvements
- Exposed the Resolve Hostname action and permitted the Send DTLS action for both licensed and trial use.
- Exposed the shutdown protection timeout and restored dependent shutdown-protection settings.
- Upgraded the Configuration Workbench with improved tab context preservation, screen reader and keyboard accessibility for the filter toolbox, refined checkbox and Syslog size layouts, and aligned service coverage with the legacy client.
- Preserved unsaved configuration edits when elevating privileges on restart.
- Enabled user-managed channel pins in the Event Monitor service and pointed online documentation links directly to product manuals.
Legacy Configuration Client
Features & Updates
- Added support for the Message Ringbuffer, Resolve Hostname, and Send DTLS actions, alongside exposure of the shutdown protection timeout settings.
- Streamlined the Licensing page to handle license-file configuration exclusively, removing outdated legacy license-key entry forms and clarifying “not yet valid” error messages with exact valid-from times.
- Ensured unsupported General settings and blocks (such as Metrics) are preserved intact across load, save, and same-format edit operations.
- Corrected LastRecord data reloading when switching channels or reopening Event Monitor configuration forms.