rsyslog 8.15.0 (v8-stable) released

We have released rsyslog 8.15.0.

This release sports a lot of changes. Among the changes are a lot of bugfixes, changes to the KSI support, pmciscoios, omkafka, 0mq modules, omelasticsearch and many more.

To get a full overview over the changes, please take a look at the Changelog.




As always, feedback is appreciated.

Best regards,
Florian Riedl

Changelog for 8.15.0 (v8-stable)

Version 8.15.0 [v8-stable] 2015-12-15

  • KSI Lib: Updated code to run with libksi
    Also libksi 3.4.0.x is required to build rsyslog if ksi support
    is enabled. New libpackages have been build as well.
  • KSI utilities: Added option to ser publication url.
    Since libksi 3.4.0.x, there is no default publication url anymore.
    The publication url has to be set using the –publications-server
    Parameter, otherwise the ksi signature cannot be verified. UserID
    and UserKey can also be set by parameter now.
    Closes https://github.com/rsyslog/rsyslog/issues/581
  • KSI Lib: Fixed wrong TLV container for KSI signatures from 0905 to 0906.
    closes https://github.com/rsyslog/rsyslog/issues/587
  • KSI/GT Lib: Fixed multiple issues found using static analyzer
  • performance improvement for configs with heavy use of JSON variables
    Depending on the config, this can be a very big gain in performance.
  • added pmpanngfw: contributed module for translating Palo Alto Networks logs.
    see also: https://github.com/rsyslog/rsyslog/pull/573
    Thanks to Luigi Mori for the contribution.
  • testbench: Changed valgrind option for imtcp-tls-basic-vg.sh
    For details see: https://github.com/rsyslog/rsyslog/pull/569
  • pmciscoios: support for asterisk before timestamp added
    thanks to github user c0by for the patch
    see also: https://github.com/rsyslog/rsyslog/pull/583
  • solr external output plugin much enhanced
    see also: https://github.com/rsyslog/rsyslog/pull/529
    Thanks to Radu Gheorghe for the patch.
  • omrabbitmq: improvements
    thanks to Luigi Mori for the patch
    see also: https://github.com/rsyslog/rsyslog/pull/580
  • add support for libfastjson (as a replacement for json-c)
  • KSI utilities: somewhat improved error messages
    Thanks to Henri Lakk for the patch.
    see also: https://github.com/rsyslog/rsyslog/pull/588
  • pmciscoios: support for some format variations
    Thanks to github user c0by for the patch
  • support grok via new contributed module mmgrok
    Thanks to 饶琛琳 (github user chenryn) for the contribution.
  • omkafka: new statistics counter “maxoutqsize”
    Thanks to 饶琛琳 (github user chenryn) for the contribution.
  • improvments for 0mq modules:
    • omczmq – suspend / Retry handling – the output plugin can now recover
      from some error states due to issues with plugin startup or message sending
    • omczmq – refactored topic handling code for ZMQ_PUB output to be a little
      more efficient
    • omczmq – added ability to set a timeout for sends
    • omczmq – set topics can be in separate frame (default) or part of message
      frame (configurable)
    • omcmzq – code cleanup
    • imczmq – code cleanup
    • imczmq – fixed a couple of cases where vars could be used uninitialized
    • imczmq – ZMQ_ROUTER support
    • imczmq – Fix small memory leak from not freeing sockets  when done with them
    • allow creation of on demand ephemeral CurveZMQ certs for encryption.
      Clients may specify clientcertpath=”*” to indicate they want an on
      demand generated cert.

    Thanks to Brian Knox for the contributions.

  • cleanup on code to unset a variable
    under extreme cases (very, very unlikely), the old code could also lead
    to errornous processing
  • omelasticsearch: build on FreeBSD
    Thanks to github user c0by for the patch
  • pmciscoios: fix some small issues clang static analyzer detected
  • testbench: many improvements and some new tests
    note that there still is a number of tests which are somewhat racy
  • overall code improvements thanks to clang static analyzer
  • gnutls fix: Added possible fix for gnutls issue #575
    see also: https://github.com/rsyslog/rsyslog/issues/575
    Thanks to Charles Southerland for the patch
  • bugfix omkafka: restore ability to build on all platforms
    Undo commit aea09800643343ab8b6aa205b0f10a4be676643b
    because that lead to build failures on various important platforms.
    This means it currently is not possible to configure the location
    of librdkafka, but that will affect far fewer people.
    closes: https://github.com/rsyslog/rsyslog/issues/596
  • bugfix omkafka: fix potentially negative partition number
    Thanks to Tait Clarridge for providing a patch.
  • bugfix: solve potential race in creation of additional action workers
    Under extreme circumstances, this could lead to segfault. Note that we
    detected this problem thanks to ASAN address sanitzier in combination
    with a very exterme testbench test. We do not think that this issue
    was ever reported in practice.
  • bugfix: potential memory leak in config parsing
    Thanks to github user linmujia for the patch
  • bugfix: small memory leak in loading template config
    This happened when a plugin was used inside the template. Then, the
    memory for the template name was never freed.
    Thanks to github user xushengping for the fix.
  • bugfix: fix extra whitespace in property expansions
    Address off-by-one issues introduced in f3bd7a2 resulting in extra
    whitespace in property expansions
    Thanks to Matthew Gabeler-Lee for the patch.
  • bugfix: mmfields leaked memory if very large messages were processed
    detected by clang static analyzer
  • bugfix: mmfields could add garbagge data to field
    this happened when very large fields were to be processed.
    Thanks to Peter Portante for reporting this.
  • bugfix: omhttpfs now also compiles with older json-c lib
  • bugfix: memory leak in (contributed) module omhttpfs
    Thanks to git hub user c6226 for the patch.
  • bugfix: parameter mismatch in error message for wrap() function
  • bugfix: parameter mismatch in error message for random() function
  • bugfix: divide by zero if max() function was provided zero
  • bugfix: invalid mutex handling in omfile async write mode
    could lead to segfault, even though highly unlikely (caught by
    testbench on a single platform)
  • bugfix: fix inconsistent number processing
    Unfortunately, previous versions of the rule engine tried to
    support oct and hex, but that wasn’t really the case.
    Everything based on JSON was just dec-converted. As this was/is
    the norm, we fix that inconsistency by always using dec.
    Luckly, oct and hex support was never documented and could
    probably only have been activated by constant numbers.
  • bugfix: timezone() object: fix NULL pointer dereference
    This happened during startup when the offset or id parameter was not
    given. Could lead to a segfault at startup.
    Detected by clang static analyzer.
  • bugfix omfile: memory addressing error if very long outchannel name used
    Thanks to github user c6226 for the patch.

rsyslog 8.9.0 (v8-stable) released

We have released rsyslog 8.9.0.

This is primarily a bug-fixing release with a couple of improvements in omprog, imuxsock and the zero message queue plugins.




As always, feedback is appreciated.

Best regards,
Florian Riedl

Changelog for 8.9.0 (v8-stable)

Version 8.9.0 [v8-stable] 2015-04-07

  • omprog: add option “hup.forward” to forwards HUP to external plugins
    This was suggested by David Lang so that external plugins (and other
    programs) can also do HUP-specific processing. The default is not
    to forward HUP, so no change of behavior by default.
  • imuxsock: added capability to use regular parser chain
    Previously, this was a fixed format, that was known to be spoken on
    the system log socket. This also adds new parameters:

    • sysSock.useSpecialParser module parameter
    • sysSock.parseHostname module parameter
    • useSpecialParser input parameter
    • parseHostname input parameter
  • 0mq: improvements in input and output modules
    See module READMEs, part is to be considered experimental.
    Thanks to Brian Knox for the contribution.
  • imtcp: add support for ip based bind for imtcp -> param “address”
    Thanks to github user crackytsi for the patch.
  • bugfix: MsgDeserialize out of sync with MsgSerialize for StrucData
    This lead to failure of disk queue processing when structured data was
    present. Thanks to github user adrush for the fix.
  • bugfix imfile: partial data loss, especially in readMode != 0
    closes https://github.com/rsyslog/rsyslog/issues/144
  • bugfix: potential large memory consumption with failed actions
    see also https://github.com/rsyslog/rsyslog/issues/253
  • bugfix: omudpspoof: invalid default send template in RainerScript format
    The file format template was used, which obviously does not work for
    forwarding. Thanks to Christopher Racky for alerting us.
    closes https://github.com/rsyslog/rsyslog/issues/268
  • bugfix: size-based legacy config statements did not work properly
    on some platforms, they were incorrectly handled, resulting in all
    sorts of “interesting” effects (up to segfault on startup)
  • build system: added option –without-valgrind-testbench
    … which provides the capability to either enforce or turn off
    valgrind use inside the testbench. Thanks to whissi for the patch.
  • rsyslogd: fix misleading typos in error messages
    Thanks to Ansgar Püster for the fixes.

Changelog for 7.4.0 (v7-stable)

Version 7.4.0  [v7.4-stable] 2013-06-06
This starts a new stable branch based on 7.3.15 plus the following changes:

  • add –enable-cached-man-pages ./configure option
    permits to build rsyslog on a system where rst2man is not installed. In that case, cached versions of the man pages are used (they were built during “make dist”, so they should be current for the version in question.
  • doc bugfix: ReadMode wrong in imfile doc, two values were swapped
    Thanks to jokajak@gmail.com for mentioning this
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=450
  • imjournal: no longer do periodic wakeup
  • bugfix: potential hang *in debug mode* on rsyslogd termination
    This ONLY affected rsyslogd if it were running with debug output enabled.
  • bugfix: $template statement with multiple spaces lead to invalid tpl name
    If multiple spaces were used in front of the template name, all but one of them became actually part of the template name. So $template   a,”…” would be name ”  a”, and as such “a” was not available, e.g. in
    *.* /var/log/file;a
    This is a legacy config problem. As it was unreported for many years, no backport of the fix to old versions will happen. This is a long-standing bug that was only recently reported by forum user mc-sim.
    Reference: http://kb.monitorware.com/post23448.html
  •  0mq fixes; credits to Hongfei Cheng and Brian Knox
Scroll to top