rsyslog

The rocket-fast system for log processing

v7

Changelog for 7.5.1 (v7-devel)

By Adiscon SupportPosted on Posted in ChangelogTagged , , , , , , , , , ,

Version 7.5.1 [devel] 2013-06-26

  • librelp 1.1.3 is required – older versions can lead to a segfault
  • add mmfields, which among others supports easy parsing of CEF messages
  • omrelp:
    * new parameter “compression.prioritystring” to control encryption parameters used by GnuTLS
  • imrelp:
    * new parameter “compression.dhbits” to control the number of bits being used for Diffie-Hellman key generation
    * new parameter “compression.prioritystring” to control encryption parameters used by GnuTLS
    * support for impstats added
    * support for setting permitted peers (client authentication) added
    * bugfix: potential segfault at startup on invalid config parameters
  • imjournal: imported patches from 7.4.1
  • omprog: add support for command line parameters
  • added experimental TCP stream compression (imptcp only, currently)
  • added BSD-specific syslog facilities
    * “console”
    * “bsd_security” – this is called “security” under BSD, but that name was unfortunately already taken by some standard facility. So I did the (hopefully) second-best thing and renamed it a little.
  • imported fixes from 7.4.2 (especially build problems on FreeBSD)
  • bugfix: imptcp did not properly initialize compression status variable could lead to segfault if stream:always compression mode was selected

rsyslog 7.4.1 (v7-stable) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , ,

This is a maintenance release, consisting primarily of bug fixes. Note that imjournal was extended to support rate-limiting, as this is needed as a safeguard for problems in systemd journal which in turn caused grief to rsyslog. See Rainer’s blog posting for more details:

http://blog.gerhards.net/2013/06/systemd-journal-causes-loop-in-imjournal.html

ChangeLog:

http://www.rsyslog.com/changelog-for-7-4-1-v7-stable/

Download:

http://www.rsyslog.com/rsyslog-7-4-1-v7-stable/

As always, feedback is appreciated.

Best regards,
Florian Riedl

Changelog for 7.4.1 (v7-stable)

By Adiscon SupportPosted on Posted in ChangelogTagged , , , , , ,

Version 7.4.1  [v7.4-stable] 2013-06-17

  • imjournal: add ratelimiting capability
    The original imjournal code did not support ratelimiting at all. We now have our own ratelimiter. This can mitigate against journal database corruption, when the journal re-sends old data. This is a current bug in systemd journal, but we won’t outrule this to happen in the future again. So it is better to have a safeguard in place. By default, we permit 20,000 messages witin 10 minutes. This may be a bit restrictive, but given the risk potential it seems reasonable.
    Users requiring larger traffic flows can always adjust the value.
  • bugfix: potential loop in rate limiting
    if the message that tells about rate-limiting gets rate-limited itself, it will potentially create and endless loop
  • bugfix: potential segfault in imjournal if journal DB is corrupted
  • bugfix: prevent a segfault in imjournal if state file is not defined
  • bugfix imzmq3: potential segfault on startup
    if no problem happend at startup, everything went fine
    Thanks to Hongfei Cheng and Brian Knox for the patch

rsyslog 7.5.0 (v7-devel) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , , , , ,

This release opens the new 7.5 development branch. Most importantly, this version provides TLS protection for RELP (note that librelp 1.1.1 is required).

More information can be found in this blogpost: http://blog.gerhards.net/2013/06/new-rsyslog-devel-branch-75.html

ChangeLog:

http://www.rsyslog.com/changelog-for-7-5-0-v7-devel/

Download:

http://www.rsyslog.com/rsyslog-7-5-0-v7-devel/

As always, feedback is appreciated.

Best regards,
Florian Riedl

rsyslog 7.4.0 (v7-stable) released

By Adiscon SupportPosted on Posted in News, Release AnnouncementTagged , , , , ,

This is the first release of the 7.4 stable branch. It incorporates all new features from the 7.3 development branch. For details, see the blog posting http://www.rsyslog.com/7-4-0-the-new-stable/
ChangeLog: http://www.rsyslog.com/changelog-for-7-4-0-v7-stable/
Download: http://www.rsyslog.com/rsyslog-7-4-0-v7-stable/

As always, feedback is appreciated.

Best regards, Florian Riedl

7.4.0 – the new stable

By Adiscon SupportPosted on Posted in News, Top NewsTagged , , , , , , , , ,

new rsyslog 7.4.0 stable released

We just released rsyslog 7.4.0, a new stable release which replaces the 7.2 branch. After nine month of hard work, there are many exciting enhancements compared to 7.2, and I thought I give you a quick rundown of the more important new features. Note that while I list some “minor features” at the end of this posting, the list is not complete. I left out those things that are primarily of interest for smaller groups of users. So if you look for a specific feature not mentioned here, it may pay to look at the ChangeLog or post a question to the rsyslog mailing list.

With this release, the rsyslog project officially supports the 7.4 and 7.2 branches. If support for older versions is required, utilizing Adiscon’s professional services for rsyslog is recommended.

Note that I only list main headlines for each of the features. Follow links (where provided) to gain more in-depth information.

Security Package

Improved Rate-Limiters

  • introduction of Linux-like rate-limiting for all inputs
  • “Last message repeated n times” now done on a per-input basis; makes it much more useful AND increases processing speed.

Systemd Journal support

  • omjournal writes messages to the journal
  • imjournal obtains messages including journal-specific meta data items from the journal

Performance Improvements

  • Disk Queue Performance greatly improved
  • DNS chache greatly improved and optimized
  • omfile now supports fully async writing
  • script optimizer now changes frequently-used long-running filters into equivalent quick ones when possible (this even affects some distros default configs and is a great performance saver)

Minor Features

  • various plugins now support the new RainerScript based config language
  • omlibdbi improvements, among them support for transactions
  • ommysql now supports transactions
  • improved omfile zip writing speed
  • performance optimizations
  • omelasticsearch improvements (bulk processing mode, local error file)
  • omudpspoof now supports packets larger than 1472 by using fragmentation
  • omrelp now supports session timeout
  • contributed module (not project-supported) omrabbitmq was added

Changelog for 7.4.0 (v7-stable)

By Adiscon SupportPosted on Posted in ChangelogTagged , , , , , , , ,

Version 7.4.0  [v7.4-stable] 2013-06-06
This starts a new stable branch based on 7.3.15 plus the following changes:

  • add –enable-cached-man-pages ./configure option
    permits to build rsyslog on a system where rst2man is not installed. In that case, cached versions of the man pages are used (they were built during “make dist”, so they should be current for the version in question.
  • doc bugfix: ReadMode wrong in imfile doc, two values were swapped
    Thanks to jokajak@gmail.com for mentioning this
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=450
  • imjournal: no longer do periodic wakeup
  • bugfix: potential hang *in debug mode* on rsyslogd termination
    This ONLY affected rsyslogd if it were running with debug output enabled.
  • bugfix: $template statement with multiple spaces lead to invalid tpl name
    If multiple spaces were used in front of the template name, all but one of them became actually part of the template name. So $template   a,”…” would be name ”  a”, and as such “a” was not available, e.g. in
    *.* /var/log/file;a
    This is a legacy config problem. As it was unreported for many years, no backport of the fix to old versions will happen. This is a long-standing bug that was only recently reported by forum user mc-sim.
    Reference: http://kb.monitorware.com/post23448.html
  •  0mq fixes; credits to Hongfei Cheng and Brian Knox
Scroll to top