8.2610.0

Scheduled-stable releases are bi-monthly snapshots of the daily-stable branch,
providing predictable update points with the same functional content as
daily-stable at the time of the snapshot.

Highlights

• Experimental producer-local queue scope for improved queue concurrency
• New Amazon Kinesis Data Streams output via omkinesis
• Global strict input startup policy via inputStartupPolicy="require-all"
• OpenSSL 4 X.509 accessor compatibility
• Improved asynchronous omfile rotation reliability
• Queue contention and Elasticsearch request-duration statistics
• Expanded Enterprise Linux packaging, including an imhttp subpackage
• Broad defensive hardening across queues, parsers, inputs, TLS, and outputs

Notable changes

Queues, concurrency, and reliability

• Experimental queue.scope="local" places bounded producer-specific front
  queues ahead of shared FixedArray or LinkedList backends, including disk
  assistance. Global scope remains the default.
• Queue processing received extensive reliability and performance work,
  including targeted worker wakeups, improved disk-assisted worker restart
  handling, safer shutdown behavior, and reduced shared-lock overhead.
• Optional queue mutex contention statistics expose contention counts and
  observed wait time through impstats.
• Existing classic disk queues retain their supported serialization format;
  Darwin ARM64 serialization now uses the expected fixed calling convention.

Inputs and startup policy

• global(inputStartupPolicy="require-all") can make configured input startup
  failures fatal, including listener and worker failures. The default remains
  best-effort startup.
• imtcp defers regex framing checks until a line boundary, reducing repeated
  scans for fragmented input.
• imudp validates receive-buffer dimensions before startup, preventing invalid
  allocation and offset arithmetic.
• imrelp rejects framing sizes beyond librelp’s supported limit.

Outputs and integrations

• The new omkinesis action sends signed Kinesis PutRecord requests with
  configurable streams, regions, credentials, payload templates, and fixed or
  template-based partition keys. RainerScript and YAML configurations are
  supported.
• Asynchronous omfile output now remains active across size-based rotation
  and avoids shutdown hangs and rotation races.
• mmaitag adds response-size, request-timeout, connect-timeout, and low-speed
  budgets while keeping provider response bodies out of failure diagnostics.
• omelasticsearch exposes request counts, duration, and interval minimum and
  maximum duration through impstats.
• The starter PostgreSQL schema accepts longer Docker and journald-style tags.

Normalization, parsing, and TLS

• mmnormalize preserves complete TurboVM results, including nested JSON and
  null values, and reports truncated results through turbo.truncated.
• RainerScript replacement and template substring results are bounded safely,
  including negative substring endpoints and large regex-match offsets.
• Empty compressed records, oversized diagnostics, and raw message offsets are
  validated before use.
• TLS certificate handling supports newer OpenSSL X.509 accessors while
  retaining compatibility with older OpenSSL versions.
• DTLS sessions that fail peer verification are closed instead of retained.
  Broken forwarding TLS sessions are explicitly aborted before descriptor reuse.

Overall hardening and security maintenance

This release includes broad defensive hardening across parsers, message
handling, queues, inputs, TLS/DTLS, compression, configuration validation, and
output actions.

It also incorporates security and robustness fixes accumulated in daily-stable
since the previous scheduled-stable release. These include bounds checks,
safer malformed-input handling, stricter certificate and peer validation,
safer dynamic paths, improved queue recovery, and protection against crashes,
resource exhaustion, busy loops, and unsafe shutdown behavior.

Compatibility notes

• Producer-local queue scope is experimental and opt-in. It requires lock-free
  64-bit atomics and monotonic condition variables; global queue scope remains
  the default.
• inputStartupPolicy="require-all" is opt-in. Existing configurations retain
  best-effort startup behavior unless the strict policy is enabled.
• New Kinesis output support requires the corresponding optional build
  dependencies when enabled.

Contributors

Thanks to everyone who contributed to this release, including:

• Andreas Hasenack
• F3dor
• FLAK-ZOSO
• Galaxy Roaming
• hanjinpeng
• Jérémie Jourdin
• Mattia Marchese
• owen-rote
• Peter de Ridder

All other changes were contributed by Adiscon GmbH.

Artifact availability

The rsyslog 8.2610.0 source release is available from the usual rsyslog download locations. Packages and container images may appear with some delay while downstream publishing completes.