Changelog

Version 4.5.5 [v4-beta] (rgerhards), 2009-10-21

• added $InputTCPServerNotifyOnConnectionClose config directive see doc for details
• bugfix: debug string larger than 1K were improperly displayed. Max size is now 32K
• bugfix: invalid storage class selected for some size config parameters. This resulted in wrong values. The most prominent victim was the directory creation mode, which was set to zero in some cases. For details, see related blog post:

  http://blog.gerhards.net/2009/10/another-note-on-hard-to-find-bugs.html

Version 5.1.6 [v5-beta] (rgerhards), 2009-10-15

• feature imports from v4.5.6
• bugfix: potential race condition when queue worker threads were terminated
• bugfix: solved potential (temporary) stall of messages when the queue was almost empty and few new data added (caused testbench to sometimes hang!)
• fixed some race condition in testbench
• added more elaborate diagnostics to parts of the testbench
• bugfixes imported from 4.5.4:
  • bugfix: potential segfault in stream writer on destruction
  • bugfix: potential race in object loader (obj.c) during use/release
  • bugfixes: potential problems in out file zip writer
• included some important fixes from 4.4.2:
  • bugfix: invalid handling of zero-sized messages
  • bugfix: zero-sized UDP messages are no longer processed
  • bugfix: random data could be appended to message
  • bugfix: reverse lookup reduction logic in imudp do DNS queries too often

Version 4.5.3 [v4-beta] (rgerhards), 2009-09-17

• bugfix: repeated messages were incorrectly processed
  this could lead to loss of the repeated message content. As a side-
  effect, it could probably also be possible that some segfault occurs
  (quite unlikely). The root cause was that some counters introduced
  during the malloc optimizations were not properly duplicated in
  MsgDup(). Note that repeated message processing is not enabled
  by default.

• bugfix: message sanitation had some issues:
  • control character DEL was not properly escaped
  • NUL and LF characters were not properly stripped if no control
    character replacement was to be done

  • NUL characters in the message body were silently dropped (this was
    a regeression introduced by some of the recent optimizations)
• bugfix: strings improperly reused, resulting in some message properties
  be populated with strings from previous messages. This was caused by
  an improper predicate check. [backported from v5]

• fixed some minor portability issues
• bugfix: reverse lookup reduction logic in imudp do DNS queries too often
  [imported from 4.4.2]

Version 5.1.5 [v5-beta] (rgerhards), 2009-09-11

• added new config option $ActionWriteAllMarkMessages this option permites to process mark messages under all circumstances, even if an action was recently called. This can be useful to use mark messages as a kind of heartbeat.
• bugfix: hostnames with dashes in them were incorrectly treated as malformed, thus causing them to be treated as TAG (this was a regression introduced from the “rfc3164 strict” change in 4.5.0). Testbench has been updated to include a smaple message with a hostname containing a dash.
• bugfix: strings improperly reused, resulting in some message properties be populated with strings from previous messages. This was caused by an improper predicate check.
  

Version 4.5.2 [v4-beta] (rgerhards), 2009-08-21

• legacy syslog parser changed so that it now accepts date stamps in wrong case. Some devices seem to create them and I do not see any harm in supporting that.
• added $InputTCPMaxListeners directive – permits to specify how many TCP servers shall be possible (default is 20).
• bugfix: memory leak with some input modules. Those inputs that use parseAndSubmitMsg() leak two small memory blocks with every message. Typically, those process only relatively few messages, so the issue does most probably not have any effect in practice.
• bugfix: if tcp listen port could not be created, no error message was emitted
• bugfix: potential segfault in output file writer (omfile) In async write mode, we use modular arithmetic to index the output buffer array. However, the counter variables accidently were signed, thus resulting in negative indizes after integer overflow. That in turn could lead to segfaults, but was depending on the memory layout of the instance in question (which in turn depended on a number of variables, like compile settings but also configuration). The counters are now unsigned (as they always should have been) and so the dangling mis-indexing does no longer happen. This bug potentially affected all installations, even if only some may actually have seen a segfault.
• bugfix: hostnames with dashes in them were incorrectly treated as malformed, thus causing them to be treated as TAG (this was a regression introduced from the “rfc3164 strict” change in 4.5.0).