rsyslog

High-performance log ingestion and ETL engine

rsyslog

High-performance log ingestion and ETL engine

rsyslog

Changelog for 5.8.9 (v5-stable)

adisconteamChangelog, , , , , ,

Version 5.8.9 [V5-stable] 2012-03-15

  • added tool to recover disk queue if .qi file is missing (recover_qi.pl)
    Thanks to Kaiwang Chen for contributing this tool
  • bugfix: stopped DA queue was never processed after a restart due to a
    regression from statistics module
  • added better doc for statsobj interface
    Thanks to Kaiwang Chen for his suggestions and analysis in regard to the
    stats subsystem.

rsyslog 5.8.9 (v5-stable) released

adisconteamNews, Release Announcement, , , , , ,

This is primarily a maintenance release. It also provides a new tool that permits the recovery of disk queues, when the queue information file (.qi) has been lost. Thanks to Kaiwang Chen for contributing this tool.

There was an important flaw in 5.8.8 that caused disk queue content to be lost after a shutdown and restart of rsyslogd. So if you run this version, an upgrade to 5.8.9 is highly suggested.

ChangeLog:

http://www.rsyslog.com/changelog-for-5-8-9-v5-stable/

Download:

http://www.rsyslog.com/rsyslog-5-8-9-v5-stable/

As always, feedback is appreciated.

Best regards,

Tim Eifler

rsyslog 5.8.8 (v5-stable) released

Adiscon SupportNews, Release Announcement, , , , , , ,

This is a bug-fixing release. It fixes the wrong computed facility and severity in imklog and a problem with rsyslog aborting on startup if no binary to execute was configured for omprog.

ChangeLog:

http://www.rsyslog.com/changelog-for-5-8-8-v5-stable/

Download:

http://www.rsyslog.com/rsyslog-5-8-8-v5-stable/

As always, feedback is appreciated.

Best regards,

Florian Riedl

rsyslog 6.3.7 (v6-devel) released

Adiscon SupportNews, Release Announcement, , , , , , ,

With this release, all builtin actions support the new v6 config format. Also, the release contains much enhanced statistics counters and various bug fixes. Recommended for all users of the v6-devel branch.

ChangeLog:

http://www.rsyslog.com/changelog-for-6-3-7-v6-devel/

Download:

http://www.rsyslog.com/rsyslog-6-3-7-v6-devel/

As always, feedback is appreciated.

Best regards,
Florian Riedl

Changelog for 6.3.7 (v6-devel)

Adiscon SupportChangelog, , , , , , , ,

Version 6.3.7  [DEVEL] 2012-02-02

  • imported refactored v5.9.6 imklog linux driver, now combined with BSD driver
  • removed imtemplate/omtemplate template modules, as this was waste of time
    The actual input/output modules are better copy templates. Instead, the now-removed modules cost time for maintenance AND often caused confusion on what their role was.
  • added  new stats objects
  • improved support for new v6 config system. The build-in output modules now all support the new config language
  • bugfix: facility local<x> was not correctly interpreted in legacy filters
    Was only accepted if it was the first PRI in a multi-filter PRI. Thanks to forum user Mark for bringing this to our attention.
  • bugfix: potential abort after reading invalid X.509 certificate
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=290
    Thanks to Tomas Heinrich for the patch
  • bufgix: legacy parsing of some filters did not work correctly
  • bugfix: rsyslog aborted during startup if there is an error in loading an action and legacy configuration mode is used
  • bugfix: bsd klog driver did no longer compile
  • relicensed larger parts of the code under Apache (ASL) 2.0

Load balancing for rsyslog

Adiscon SupportFAQ, ,

To use rsyslog effectively in a cluster, one could use the iptables CLUSTERIP feature on linux to setup one IP address that gets shared across the cluster of systems. A heartbeat (with the pacemaker cluster management layer) can keep track of the cluster and make sure that there is always a box handling the traffic.

It does use a multicast MAC address to send the traffic to multiple machines. The kernel does a hash on (one or more of) the source IP, source port, destination IP and destination port. It then divides this hash into buckets (machine 1 of 10) and if it falls into the bucket for this machine, it then sends the packet on to the application. Otherwise the kernel drops the packet.

This has the advantage of not needing any other systems. It can be done entirely on the receiving cluster.

A different approach would be to setup a LVS (Linux Virtual Server) load balancer (or any other commercial load balancer) to divide the TCP traffic.

Note: In any of these configurations, one will want to consider the tcprebindinterval config directive of rsyslog on the sending machines, so they will periodically close and re-open their connection (so that the source port changes). Otherwise one can end up with the traffic being unbalanced between the systems without any way to re-balance the load.

Scroll to top