log file encryption

new rsyslog 7.4.0 stable released

We just released rsyslog 7.4.0, a new stable release which replaces the 7.2 branch. After nine month of hard work, there are many exciting enhancements compared to 7.2, and I thought I give you a quick rundown of the more important new features. Note that while I list some “minor features” at the end of this posting, the list is not complete. I left out those things that are primarily of interest for smaller groups of users. So if you look for a specific feature not mentioned here, it may pay to look at the ChangeLog or post a question to the rsyslog mailing list.

With this release, the rsyslog project officially supports the 7.4 and 7.2 branches. If support for older versions is required, utilizing Adiscon’s professional services for rsyslog is recommended.

Note that I only list main headlines for each of the features. Follow links (where provided) to gain more in-depth information.

Security Package

• Log Anonymization
• Log File Signature [some background info]
• Log File Encryption

Improved Rate-Limiters

• introduction of Linux-like rate-limiting for all inputs
• “Last message repeated n times” now done on a per-input basis; makes it much more useful AND increases processing speed.

Systemd Journal support

• omjournal writes messages to the journal
• imjournal obtains messages including journal-specific meta data items from the journal

Performance Improvements

• Disk Queue Performance greatly improved
• DNS chache greatly improved and optimized
• omfile now supports fully async writing
• script optimizer now changes frequently-used long-running filters into equivalent quick ones when possible (this even affects some distros default configs and is a great performance saver)

Minor Features

• various plugins now support the new RainerScript based config language
• omlibdbi improvements, among them support for transactions
• ommysql now supports transactions
• improved omfile zip writing speed
• performance optimizations
• omelasticsearch improvements (bulk processing mode, local error file)
• omudpspoof now supports packets larger than 1472 by using fragmentation
• omrelp now supports session timeout
• contributed module (not project-supported) omrabbitmq was added