rsyslog

High-performance log ingestion and ETL engine

rsyslog

High-performance log ingestion and ETL engine

Version

Rsyslog Windows Agent 8.2 Released

friedlNews, news-rwa, ,

A new version of the rsyslog Windows Agent is now available, version 8.2. This update delivers targeted stability improvements, performance optimizations for high-throughput environments, and enhanced compatibility with modern Windows operating systems.

Core Service & Engine Enhancements

High-Load Connection & Performance Optimizations

This release significantly improves the agent’s resilience under heavy traffic. Incoming TCP connections now benefit from an increased listen backlog and more reliable handling during connection spikes. Furthermore, timestamp processing across log messages is more reliable, backed by faster parsing for common log timestamp formats. Rule search expression evaluation has also been optimized for greater speed, accompanied by updated documentation.

Stability & Message Handling

Filter rule evaluation has been stabilized to resolve edge-case issues during message processing. Output formatting logic has been refined to ensure predictable message content preparation prior to forwarding or storage. In addition, character set conversions are now clearer and more consistent across operations.

Operating System Compatibility & Diagnostics

Configuration validation has been tightened to ensure reliable loading of configuration version details. Windows Event Log handling has been updated to ensure event category names render correctly on modern operating systems, including Windows 11 and Windows Server 2025. Finally, diagnostic and debug error messages now display correctly across all supported languages and character encodings.

Download

The new release is available for immediate download through the official page:

Download rsyslog Windows Agent 8.2.0

RSyslog Windows Agent 8.0 Released

friedlNews, Release Announcement, , ,

Release Date: 2025-01-23

Build-IDs: Service 8.0.0.230, Client 8.0.0.320

Enhancements

  • DTLS Action: Added support for DTLS Action to enhance secure logging capabilities over the UDP protocol.
  • Property Engine: Added microseconds support to timestamps for improved precision (When parsing RFC 5424 timestamps).
  • OpenSSL: Updated OpenSSL library to a newer version and added TLS v1.3 compatibility testing.
  • RELP Action: Introduced custom output encoding options for improved flexibility.

Bugfixes

  • Syslog Action: Fixed memory leak in RFX5424 Syslog Header processing.
  • File Action: Improved handling for “LogRotation by time of the day” to prevent duplicate log rotations on the same day after restart.
  • Engine: Fixed invalid parameter issue during char-to-wchar_t conversion.

You can download Free Trial Version of RSyslog Windows Agent.

RSyslog Windows Agent 7.2 Released

friedlRelease Announcement, , , ,

Release Date: 2022-01-18

Build-IDs: Service 7.2.0.217, Client 7.2.0.310

Features

  • Syslog Service: Added configurable option to detect Year in RFC3164 Syslog Header. If enabled, the service will try to detect a Year after the usual RFC3164 Date Header.
  • Syslog Service: Added configurable message size limit for syslog tcp messages. The default is 1MB which is far more as defined in syslog rfcs.

Bugfixes

  • EventLog Monitor v2: Fix handling of empty Debug/analytic channels.
  • TLS: Fix a problem with X509 Certificate Checking (Server Side).
  • File Config: Fixed a problem loading big numbers (Signed/Unsigned).
  • Queue Engine: Add limit to queue full warnings/errors events  to avoid spamming the eventlog.
  • Engine: Increased stability.

You can download Free Trial Version of RSyslog Windows Agent.

RSyslog Windows Agent 7.1 Released

friedlRelease Announcement, , , , , , No Comments on RSyslog Windows Agent 7.1 Released

Release Date: 2021-07-14

Build-IDs: Service 7.1.0.214, Client 7.1.0.300

Features

  • EventLog Monitor V2: Add support to monitor Analytic and Debug Channels. These channels will only work in polling mode and detection of the last record is limited due the nature of analytic / debug channels.
  • EventLog Monitor V2: Added new “Copy Messageformat into property” option to copy a second output format into a custom property.
  • File Monitor: Added support for batched processing which is a huge improvement regarding processing speed.

Bugfixes

  • EventLog Monitor v2: Removed unnecessary spaces within LOGSIEM JSON format.
  • File Monitor: Fixed a race condition saving the correct file position on action failure.
  • Status Actions: Fixed an issue calculating wrong values when multiple compute status actions were executed at the same time.

You can download Free Trial Version of RSyslog Windows Agent.

RSyslog Windows Agent 6.2c Released

friedlNews, , ,

Release Date: 2021-01-28

Build-IDs: Service 6.2.0.210, Client 6.2.0.284

Bugfixes

  • Syslog Service: Fixed an parsing issue of the syslogtag (rfc5424 only) with malformed syslog headers.
  • Syslog Service: Fixed an issue where two nullbytes were appended to the rawsyslogmsg property.
  • EventLog Monitor V2: Fixed Unicode support when using JSON Output format.
  • IPv6: Fixed a conversion issue when a source was converted into a IPv6 address string.

You can download Free Trial Version of RSyslog Windows Agent.

RSyslog Windows Agent 6.1 Released

friedlRelease Announcement, , , , No Comments on RSyslog Windows Agent 6.1 Released

Release Date: 2020-01-31

Build-IDs: Service 6.1.0.205, Client 6.1.0.280

Features

  • Property engine: Added new static property %localhostname% which contains the local computer name.
  • Syslog Action: Fixed Syslog Version in RFC5424 Header to 1.

Bugfixes

  • EventLog Monitor V2: Fixed an issue losing the first record LastRecord was resetted.
  • EventLog Monitor V2: Fixed minor issues in new caching code.
  • Queue Engine: Fixed an issue in the Action retry logic which caused the same information to be reprocessed again.
  • Property Engine: Fixed an issue initializing the socket subsystem if no network action/service was used related to the toipv4address/toipv6address options.
  • Engine: Fixed multiple memory leaks when a name was resolvedto an IP address.

You can download Free Trial Version of RSyslog Windows Agent.

RSyslog Windows Agent 5.1 Released

friedlRelease Announcement, , No Comments on RSyslog Windows Agent 5.1 Released

Release Date: 2018-08-23

Build-IDs: Service 5.1.0.193, Client 5.1.0.269

Features

  • Send RELP Action: Updated Librelp library to 1.2.17
  • Send RELP Action: Added TLS support (using OpenSSL library).
  • TLS Support: Added support for anonymous communication (Certless).
  • TLS Support: Added support to enable /disabled TLS communication methods.
  • TLS Support: Added support for setting advanced OpenSSL command parameters.
  • Property Engine: Added new option “cef” to convert a string into McAfee CEF Format.
  • OpenSSL: Added support to pass through OpenSSL diagnostic information into our own debugging system.
  • Lognorm Action: Added support to convert Array types into properties, printing converted properties into debug log now.

Bugfixes

  • File Monitor: Fixed issue with REGEX Message Separators when first char of message was matching.
  • Lognorm Action: Fixed issue that stopped Action from working when Output format was set to disabled.
  • Lognorm Action: Fixed issue when shutting down Service or doing a configuration reload when Lognorm Action is used.
  • TLS Support: Removed expired internal certificates.

You can download Free Trial Version of RSyslog Windows Agent.

Version support policy change

adisconteamNews, , , ,

We will be changing our policy so that only the latest stable build will be officially supported. This is done in an effort to concentrate resouces on building new and great things, instead of wasting a lot of time merging from old versions. A lot of -competing- projects have this policy and thus can move faster. We don’t want to carry that disadvantage any further with us.

For folks with support contracts, of course nothing changes: we always supported all versions – no matter how old – under these contracts (as long as technically possible). Please also note that we always consider older, but frequently used versions when it comes to important bug fixes (for example, I lately added a couple of fixes to v5.10, which is no longer officially supported for quite a while).

I would like to point out that rsyslog has a very considerate version management, with keeping major versions in different branches and (via professional support) taking care of each old version. This enterprise release scheme is under no discussion.

As a side-note: the discussion was started when I thought about non-critical fixes that I did for v7 and we thought about if it really makes sense to spend time to backport them to v6. There are also some enhancement-like “bugfixes” (like better config error messages), which will stay with the devel branch and mature into the next stable (if for nothing else, than for their regression potential).

Best regards,
Rainer Gerhards

Scroll to top