rsyslog

The rocket-fast system for log processing

v6

Changelog for 6.3.8 (v6-devel)

By Adiscon SupportPosted on Posted in ChangelogTagged , , , , , ,

Version 6.3.8  [DEVEL] 2012-04-16

  • added $PStatJSON directive to permit stats records in JSON format
  • added “date-unixtimestamp” property replacer option to format as a unix timestamp (seconds since epoch)
  • added “json” property replacer option to support JSON encoding on a per-property basis
  • added omhiredis (contributed module)
  • added mmjsonparse to support recognizing and parsing JSON enhanced syslog messages
  • upgraded more plugins to support the new v6 config format:
    – ommysql
    – omlibdbi
    – omsnmp
  • added configuration directives to customize queue light delay marks $MainMsgQueueLightDelayMark, $ActionQueueLightDelayMark; both specify number of messages starting at which a delay happens.
  • added message property parsesuccess to indicate if the last run higher-level parser could successfully parse the message or not  (see property replacer html doc for details)
  • bugfix: abort during startup when rsyslog.conf v6+ format was used in a certain way
  • bugfix: property $!all-json made rsyslog abort if no normalized data was available
  • bugfix: memory leak in array passing output module mode
  • added configuration directives to customize queue light delay marks permit size modifiers (k,m,g,…) in integer config parameters
    Thanks to Jo Rhett for the suggestion.
  • bugfix: hostname was not requeried on HUP
    Thanks to Per Jessen for reporting this bug and Marius Tomaschewski for his help in testing the fix.
  • bugfix: imklog invalidly computed facility and severity
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=313
  • added configuration directive to disable octet-counted framing for imtcp, directive is $InputTCPServerSupportOctetCountedFraming for imptcp, directive is $InputPTCPServerSupportOctetCountedFraming
  • added capability to use a local interface IP address as fromhost-ip for locally originating messages. New directive $LocalHostIPIF

rsyslog 6.3.7 (v6-devel) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , , , ,

With this release, all builtin actions support the new v6 config format. Also, the release contains much enhanced statistics counters and various bug fixes. Recommended for all users of the v6-devel branch.

ChangeLog:

http://www.rsyslog.com/changelog-for-6-3-7-v6-devel/

Download:

http://www.rsyslog.com/rsyslog-6-3-7-v6-devel/

As always, feedback is appreciated.

Best regards,
Florian Riedl

Changelog for 6.3.7 (v6-devel)

By Adiscon SupportPosted on Posted in ChangelogTagged , , , , , , , ,

Version 6.3.7  [DEVEL] 2012-02-02

  • imported refactored v5.9.6 imklog linux driver, now combined with BSD driver
  • removed imtemplate/omtemplate template modules, as this was waste of time
    The actual input/output modules are better copy templates. Instead, the now-removed modules cost time for maintenance AND often caused confusion on what their role was.
  • added  new stats objects
  • improved support for new v6 config system. The build-in output modules now all support the new config language
  • bugfix: facility local<x> was not correctly interpreted in legacy filters
    Was only accepted if it was the first PRI in a multi-filter PRI. Thanks to forum user Mark for bringing this to our attention.
  • bugfix: potential abort after reading invalid X.509 certificate
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=290
    Thanks to Tomas Heinrich for the patch
  • bufgix: legacy parsing of some filters did not work correctly
  • bugfix: rsyslog aborted during startup if there is an error in loading an action and legacy configuration mode is used
  • bugfix: bsd klog driver did no longer compile
  • relicensed larger parts of the code under Apache (ASL) 2.0

rsyslog 6.2.0 (v6-stable) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , ,

This is the initial stable release of rsyslog v6. It is basically the last beta version plus some more fixes. This version provides functional and performance enhancements, for example the Hadoop (HDFS) support has been considerably speeded up by supporting batched insert mode. Also, TCP transmission overhead for TLS has been dramatically improved. TCP now also supports input worker thread pools. Most importantly, rsyslog now supports log normalization via liblognorm rule bases. This permits very high performance normalization of semantically equal messages from different devices (and thus in different syntaxes).

Note that config scoping, available in the beta versions, is NOT supported by v6-stable. This was decided because it would have been functionality equivalent to the new config language upcoming in v6.3 (already available as part of the devel version). As scoping was not available in any earlier versions, introducing it in v6.2 would have added, in the long term, just another method of doing some identicaly thing via the ugly old config language. This would have lead to user confusion and more complex than necessary code. If you are interested in the cleaner config language, we strongly encourage you to have a look at rsyslog 6.3.

With the arrival of the stable v6 version, version 4 will be retired and is no longer officially supported (but support is provided under maintenance contracts, of course).

ChangeLog:

http://www.rsyslog.com/changelog-for-6-2-0-v6-stable/

Download:

http://www.rsyslog.com/rsyslog-6-2-0-v6-stable/

As always, feedback is appreciated.

Best regards,
Florian Riedl

Changelog for 6.2.0 (v6-stable)

By Adiscon SupportPosted on Posted in ChangelogTagged , , , , ,

ChangeLog (from 6.1.12 to 6.2.0):

  • bugfix (kind of): removed numerical part from pri-text see v6 compatibility document for reasons
  • bugfix: race condition when extracting program name, APPNAME, structured data and PROCID (RFC5424 fields) could lead to invalid characters e.g. in dynamic file names or during forwarding (general malfunction of these fields in templates, mostly under heavy load)
  • bugfix: imuxsock did no longer ignore message-provided timestamp, if so configured (the *default*). Lead to no longer sub-second timestamps.
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=281
  • bugfix: omfile returns fatal error code for things that go really wrong previously, RS_RET_RESUME was returned, which lead to a loop inside the rule engine as omfile could not really recover.
  • bugfix: rsyslogd -v always said 64 atomics were not present
    thanks to mono_matsuko for the patch
  • bugfix: potential abort after reading invalid X.509 certificate closes:
    http://bugzilla.adiscon.com/show_bug.cgi?id=290
    Thanks to Tomas Heinrich for the patch
  • $Begin, $End, $StrictScoping directives have been removed as v6.4 will provide the same functionality in a far better way. So we do not want to clutter the code.

rsyslog 6.3.6 (v6-devel) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , , , ,

We have just released a new development version of rsyslog v6. This is primarily a maintenance release fixing a really annoying problem with reading the config file.

ChangeLog:

http://www.rsyslog.com/changelog-for-6-3-6-v6-devel/

Download:

http://www.rsyslog.com/rsyslog-6-3-6-v6-devel/

As always, feedback is appreciated.

Best regards,
Florian Riedl

rsyslog multiple buxfixes released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , , , , , , , , , , ,

Hi all,

There has a security issue been identified that can potentially lead to DoS. It is triggered by malformed RFC3164 messages. An abort only happens under very specific environmental trigger factors. Full details can be found in our security advisory here:

http://www.rsyslog.com/potential-dos-with-malformed-tag/

We would like to thank the Red Hat security team for finding this issue and working with us to resolve it.

As a consequence, we have updated all currently active versions. Please note that they do not only contain the fix for the security issue mentioned above but also other stability updates. For obvious reasons, updating to these versions is recommended. For details, please see the relevant ChangeLog.

  • v4-stable: 4.6.8
  • v4-beta: 4.7.5
  • v5-stable: 5.8.5
  • v5-devel: 5.9.3
  • v6-beta: 6.1.12
  • v6-devel: 6.3.5

All versions are available right now. If you do not want to update, you should consider applying an update to older versions. The fix is trivial, so it should apply to all vulnerable versions without problems (but we have not checked the myriad of versions out there). The security advisory contains the details.

The Changelogs and Download Links can be found below:

As always, feedback is appreciated.

Best regards,
Florian Riedl

Scroll to top