7.3.5

Version 7.3.5 [devel] 2012-12-19

• ommysql: addded batching/transaction support
• enhanced script optimizer to optimize common PRI-based comparisons
  These constructs are especially used in SUSE default config files,
  but also by many users (as they are more readable than the equivalent
  PRI-based filter).
• omudpspoof: add support for new config system
• omudpspoof: add support for packets larger than 1472 bytes
  On Ethernet, they need to be transmitted in multiple fragments. While
  it is known that fragmentation can cause issues, it is the best choice
  to be made in that case. Also improved debug output.
• bugfix: omudpspoof failed depending on the execution environment
  The v7 engine closes fds, and closed some of libnet’s fds as well, what
  lead to problems (unfortunately, at least some libnet versions do not
  report a proper error state but still “success”…). The order of libnet
  calls has been adjusted to by in sync with what the core engine does.
• bugfix: segfault on imuxsock startup if system log socket is used
  and no ratelimiting supported. Happens only during initial config
  read phase, once this is over, everything works stable.
• bugfix: mmnormalize build problems
• bugfix: mmnormalize could abort rsyslog if config parameter was in error
• bugfix: no error message for invalid string template parameters
  rather a malformed template was generated, and error information emitted
  at runtime. However, this could be quite confusing. Note that with this
  “bugfix” user experience changes: formerly, rsyslog and the affected
  actions properly started up, but the actions did not produce proper
  data. Now, there are startup error messages and the actions are NOT
  executed (due to missing template due to template error).
• bugfix[minor]: invalid error code when mmnormalize could not access rulebase
• bugfix(kind of): script optimizer did not work for complex boolean expressions
• doc bugfix: corrections and improvements in mmnormalize html doc page
• bugfix: some message properties could be garbled due to race condition
  This happened only on very high volume systems, if the same message was
  being processed by two different actions. This was a regression caused
  by the new config processor, which did no longer properly enable msg
  locking in multithreaded cases. The bugfix is actually a refactoring of
  the msg locking code – we no longer do unlocked operations, as the use
  case for it has mostly gone away. It is potentially possible only at
  very low-end systems, and there the small additional overhead of doing
  the locking does not really hurt. Instead, the removal of that
  capability can actually slightly improve performance in common cases,
  as the code path is smaller and requires slightly less memory writes.
  That probably outperforms the extra locking overhead (which in the
  low-end case always happens in user space, without need for kernel
  support as we can always directly aquire the lock – there is no
  contention at all).
• build system cleanup (thanks to Michael Biebl for this!)
• bugfix: omelasticsearch did not properly compile on some platforms
  due to missing libmath. Thanks to Michael Biebl for the fix.