Softpedia >Linux >System >Logging >rsyslog >  Changelog

rsyslog Changelog

What's new in rsyslog 8.11.0

Jul 21, 2015
  • new signature provider for Keyless Signature Infrastructure (KSI) added
  • build system: re-enable use of "make distcheck"
  • bugfix imfile: regex multiline mode ignored escapeLF option
  • bugfix omkafka: fixed several concurrency issues, most of them related to dynamic topics.
  • bugfix: execonlywhenpreviousissuspended did not work correctly. This especially caused problems when an action with this attribute was configured with an action queue.
  • bugfix core engine: ensured global variable atomicity. This could lead to problems in RainerScript, as well as probably in other areas where global variables are used inside rsyslog. I wouldn’t outrule it could lead to segfaults.
  • bugfix imfile: segfault when using startmsg.regex because of empty log line
  • bugfix: build problem on Solaris
  • bugfix: build system strndup was used even if not present now added compatibility function. This came up on Solaris builds.

New in rsyslog 8.10.0 (Jun 10, 2015)

  • imfile: add capability to process multi-line messages based on regex input parameter "endmsg.regex" was added for that purpose. The new mode provides much more power in processing different multiline-formats.
  • pmrfc3164: add new parameters
  • "detect.yearAfterTimestamp"
  • This supports timestamps as generated e.g. by some Aruba Networks equipment.
  • "permit.squareBracesInHostname"
  • Permits to use "hostnames" in the form of "[127.0.0.1]"; also seen in Aruba Networks equipment, but we strongly assume this can also happen in other cases, especially with IPv6.
  • supplementary groups are now set when dropping privileges
  • closes https://github.com/rsyslog/rsyslog/issues/296
  • Thanks to Zach Lisinski for the patch.
  • imfile: added brace glob expansion to wildcard
  • Thanks to Zach Lisinski for the patch.
  • zmq: add the ability for zeromq input and outputs to advertise their presence on UDP via the zbeacon API.
  • Thanks to Brian Knox for the contribution.
  • added omhttpfs: contributed module for writing to HDFS via HTTP
  • Thanks to sskaje for the contribution.
  • Configure option "–disable-debug-symbols" added which is disabled per default. If you set the new option, configure won’t set the appropriate compiler flag to generate debug symbols anymore.
  • When building from git source we now require rst2man and yacc (or a replacement like bison).
  • That isn’t any new requirement, we only added missing configure checks.
  • Configure option "–enable-generate-man-pages" is now disabled for non git source builds per default but enforced when building from git source.
  • mmpstrucdata: some code cleanup
  • removed lots of early development debug outputs
  • bugfix imuxsock: fix a crash when setting a hostname
  • Setting a hostname via the legacy directive would lead to a crash during shutdown caused by a double-free.
  • Thanks to Tomas Heinrich for the patch.
  • bugfix: memory leak in mmpstrucdata
  • Thanks to Grégoire Seux for reporting this issue.
  • closes https://github.com/rsyslog/rsyslog/issues/310
  • bugfix (minor): default action name: assigned number was one off
  • see also https://github.com/rsyslog/rsyslog/pull/340
  • Thanks to Tomas Heinrich for the patch.
  • bugfix: memory leak in imfile
  • A small leak happened each time a new file was monitored based on a wildcard. Depending on the rate of file creation, this could result in a serious memory leak.

New in rsyslog 8.10.0 (Jun 10, 2015)

  • imfile: add capability to process multi-line messages based on regex input parameter "endmsg.regex" was added for that purpose. The new mode provides much more power in processing different multiline-formats.
  • pmrfc3164: add new parameters
  • "detect.yearAfterTimestamp"
  • This supports timestamps as generated e.g. by some Aruba Networks equipment.
  • "permit.squareBracesInHostname"
  • Permits to use "hostnames" in the form of "[127.0.0.1]"; also seen in Aruba Networks equipment, but we strongly assume this can also happen in other cases, especially with IPv6.
  • supplementary groups are now set when dropping privileges
  • closes https://github.com/rsyslog/rsyslog/issues/296
  • Thanks to Zach Lisinski for the patch.
  • imfile: added brace glob expansion to wildcard
  • Thanks to Zach Lisinski for the patch.
  • zmq: add the ability for zeromq input and outputs to advertise their presence on UDP via the zbeacon API.
  • Thanks to Brian Knox for the contribution.
  • added omhttpfs: contributed module for writing to HDFS via HTTP
  • Thanks to sskaje for the contribution.
  • Configure option "–disable-debug-symbols" added which is disabled per default. If you set the new option, configure won’t set the appropriate compiler flag to generate debug symbols anymore.
  • When building from git source we now require rst2man and yacc (or a replacement like bison).
  • That isn’t any new requirement, we only added missing configure checks.
  • Configure option "–enable-generate-man-pages" is now disabled for non git source builds per default but enforced when building from git source.
  • mmpstrucdata: some code cleanup
  • removed lots of early development debug outputs
  • bugfix imuxsock: fix a crash when setting a hostname
  • Setting a hostname via the legacy directive would lead to a crash during shutdown caused by a double-free.
  • Thanks to Tomas Heinrich for the patch.
  • bugfix: memory leak in mmpstrucdata
  • Thanks to Grégoire Seux for reporting this issue.
  • closes https://github.com/rsyslog/rsyslog/issues/310
  • bugfix (minor): default action name: assigned number was one off
  • see also https://github.com/rsyslog/rsyslog/pull/340
  • Thanks to Tomas Heinrich for the patch.
  • bugfix: memory leak in imfile
  • A small leak happened each time a new file was monitored based on a wildcard. Depending on the rate of file creation, this could result in a serious memory leak.

New in rsyslog 8.8.0 (Mar 10, 2015)

  • omkafka: add support for dynamic topics and auto partitioning. Thanks to Tait Clarridge for the patches.
  • imtcp/imptcp: support for broken Cisco ASA TCP syslog framing
  • omfwd: more detailled error messages in case of UDP send error
  • TLS syslog: enable capability to turn on GnuTLS debug logging. This provides better diagnostics in hard-to-diagnose cases, especially when GnuTLS is extra-picky about certificates.
  • bugfix: $AbortOnUncleanConfig did not work
  • improve rsyslogd -v output and error message with meta information version number is now contained in error message and build platform in version output. This helps to gets rid of the usual "which version" question on mailing list, support forums, etc…
  • bugfix imtcp: octet-counted framing cannot be turned off
  • bugfix: build problems on Illuminos. Thanks to Andrew Stormont for the patch
  • bugfix: invalid data size for iMaxLine global property. It was defined as int, but inside the config system it was declared as size type, which uses int64_t. With legacy config statements, this could lead to misadressing, which usually meant the another config variable was overwritten (depending on memory layout). closes https://github.com/rsyslog/rsyslog/issues/205
  • bugfix: negative values for maxMessageSize global parameter were permitted

New in rsyslog 8.7.0 (Jan 21, 2015)

  • add message metadata "system" to msg object. this permits to store metadata alongside the message
  • imfile: add support for "filename" metadata. this is useful in cases where wildcards are used
  • imptcp: make stats counter names consistent with what imudp, imtcp uses
  • added new module "omkafka" to support writing to Apache Kafka
  • omfwd: add new "udp.senddelay" parameter
  • mmnormalize enhancements. Thanks to Janmejay Singh for the patch.
  • RainerScript "foreach" iterator and array reading support. Thanks to Janmejay Singh for the patch.
  • now requires liblognorm >= 1.0.2
  • add support for systemd >= 209 library names
  • BSD "ntp" facility (value 12) is now also supported in filter. Thanks to Douglas K. Rand of Iteris, Inc. for the patch. Note: this patch was released under ASL 2.0 (see email-conversation).
  • bugfix: global(localHostName="xxx") was not respected in all modules
  • bugfix: emit correct error message on config-file-not-found. closes https://github.com/rsyslog/rsyslog/issues/173
  • bugfix: impstats emitted invalid JSON format (if JSON was selected)
  • bugfix: (small) memory leak in omfile’s outchannel code. Thanks to Koral Ilgun for reporting this issue.
  • bugfix: imuxsock did not deactivate some code not supported by platform. Among potential other problemns, this caused build failure under Solaris. Note that this build problem just made a broader problem appear that so far always existed but was not visible. closes https://github.com/rsyslog/rsyslog/issues/185

New in rsyslog 8.6.0 (Dec 5, 2014)

  • configuration-setting rsyslogd command line options deprecated
  • For most of them, there are now proper configuration objects. Some few will be completely dropped if nobody insists on them. Additional info at
  • http://blog.gerhards.net/2014/11/phasing-out-legacy-command-line-options.html
  • new and enhanced plugins for 0mq. These are currently experimantal.
  • Thanks to Brian Knox who contributed the modules and is their author.
  • empty rulesets have been permitted. They no longer raise a syntax error.
  • add parameter -N3 to enable config check of partial config file
  • Use for config include files. Disables checking if any action exists at
  • all.
  • rsyslogd -e option has finally been removed
  • It is deprectated since many years.
  • testbench improvements
  • Testbench is now more robust and has additional tests.
  • testbench is now by default disabled
  • To enable it, use –enable-testbench. This was done as the testbench now does better checking if required modules are present and this in turn would lead to configure error messages where non previously were if we would leave –enable-testbench on by default. Thus we have turned it off. This should not be an issue for those few testbench users.
  • add new RainerScript functions warp() and replace()
  • Thanks to Singh Janmejay for the patch.
  • mmnormalize can now also work on a variable
  • Thanks to Singh Janmejay for the patch.
  • new property date options for day ordinal and week number
  • Thanks to github user arrjay for the patch
  • remove –enable-zlib configure option, we always require it
  • It’s hard to envision a system without zlib, so we turn this off
  • closes https://github.com/rsyslog/rsyslog/issues/76
  • slight source-tree restructuring: contributed modules are now in their own ./contrib directory. The idea is to make it clearer to the end user which plugins are supported by the rsyslog project (those in ./plugins).
  • bugfix: imudp makes rsyslog hang on shutdown when more than 1 thread used
  • closes https://github.com/rsyslog/rsyslog/issues/126
  • bugfix: not all files closed on auto-backgrounding startup
  • This could happen when not running under systemd. Some low-numbered fds were not closed in that case.
  • bugfix: typo in queue configuration parameter made parameter unusable
  • Thanks to Bojan Smojver for the patch.
  • bugfix: unitialized buffer off-by-one error in hostname generation
  • The DNS cache used uninitialized memory, which could lead to invalid hostname generation.
  • Thanks to Jarrod Sayers for alerting us and provinding analysis and patch recommendations.
  • bugfix imuxsock: possible segfault when SysSock.Use="off"
  • Thanks to alexjfisher for reporting this issue.
  • closes https://github.com/rsyslog/rsyslog/issues/140
  • bugfix: RainerScript: invalid ruleset names were accepted during ruleset defintion, but could of course not be used when e.g. calling a ruleset.
  • IMPORTANT: this may cause existing configurations to error out on start, as they invalid names could also be used e.g. when assigning rulesets.
  • bugfix: some module entry points were not called for all modules callbacks like endCnfLoad() were primarily being called for input modules. This has been corrected. Note that this bugfix has some regression potential.
  • bugfix omlibdbi: connection was taken down in wrong thread
  • This could have consequences depending on the driver being used. In general, it looks more like a cosmetic issue. For example, with MySQL it lead to a small memory but also an annoying message about a thread not properly torn down.
  • imttcp was removed because it was an incompleted experimental module
  • pmrfc3164sd because it was a custom module nobody used
  • We used to keep this as a sample inside the tree, but whoever wants to look at it can check in older versions inside git
  • omoracle was removed because it was orphaned and did not build/work for quite some years and nobody was interested in fixing it

New in rsyslog 8.4.2 (Oct 20, 2014)

  • bugfix: the fix for CVE-2014-3634 did not handle all cases. This is corrected now. see also: CVE-2014-3683
  • fixed a build problem on some platforms. Thanks to Olaf for the patch
  • behaviour change: "msg" of messages with invalid PRI set to "rawmsg". When the PRI is invalid, the rest of the header cannot be valid. So we move all of it to MSG and do not try to parse it out. Note that this is not directly related to the security issue but rather done because it makes most sense.

New in rsyslog 7.6.0 (Feb 13, 2014)

  • Bugfix: imuxsock input parameters were not accepted due to copy&paste error.
  • Thanks to Andy Goldstein for the fix.
  • Added ProcessInternalMessages global system parameter
  • This permits to inject rsyslog status messages into *another* main syslogd or the journal.
  • New dependency: liblogging-stdlog (for submitting to external logger)
  • Bugfix: json templates are improperly created
  • Strings miss the terminating NUL character, which obviously can lead to all sorts of problems.
  • See also: https://github.com/rsyslog/rsyslog/issues/27
  • Thanks to Alain for the analysis and the patch.
  • ompgsql bugfix: improper handling of auto-backgrounding mode
  • If rsyslog was set to auto-background itself (default code behaviour, but many distros now turn it off for good reason), ompgsql could not properly connect. This could even lead to a segfault. The core reason was that a PG session handle was kept open over a fork, something that is explicitely forbidden in the PG API.
  • Thanks to Alain for the analysis and the patch.

New in rsyslog 7.4.9 (Jan 23, 2014)

  • added ProcessInternalMessages global system parameter
  • This permits to inject rsyslog status messages into *another* main syslogd or the journal.
  • bugfix: imuxsock input parameters were not accepted due to copy&paste error. Thanks to Andy Goldstein for the fix.
  • bugfix: potential double-free in RainerScript equal comparison happens if the left-hand operand is JSON object and the right-hand operand is a non-string that does not convert to a number (for example, it can be another JSON object, probably the only case that could happen in practice). This is very unlikely to be triggered.
  • bugfix: some RainerScript Json(Variable)/string comparisons were wrong

New in rsyslog 8.1.4 (Jan 15, 2014)

  • add exec_template() RainerScript function
  • imrelp: support for TCP KEEPALIVE added
  • bumped librelp dependency to 1.2.2 to support new KEEPALIVE feature
  • Add directives for numerically specifying GIDs/UIDs
  • The already present directives (FileOwner, FileGroup, DirOwner, DirGroup) translate names to numerical IDs, which depends on the user information being available during rsyslog’s startup. This can fail if the information is obtained over a network or from a service such as SSSD. The new directives provide a way to specify the numerical IDs directly and bypass the lookup.
  • Thanks to Tomas Heinrich for the patch.
  • bugfix: action commitTransaction() processing did not properly handle suspended actions
  • bugfix: omelasticsearch fail.es stats counter was improperly maitained

New in rsyslog 7.4.8 (Jan 13, 2014)

  • rsgtutil provides better error messages on unfinished signature blocks
  • bugfix: guard against control characters in internal (error) messages
  • Thanks to Ahto Truu for alerting us.
  • bugfix: immark did emit messages under kern.=info instead of syslog.=info
  • Note that his can potentially break exisiting configurations that rely on immark sending as kern.=info. Unfortunately, we cannot leave this unfixed as we never should emit messages under the kern facilit

New in rsyslog 7.4.7 (Dec 11, 2013)

  • bugfix: limiting queue disk space did not work properly
  • queue.maxdiskspace actually initializes queue.maxfilesize
  • total size of queue files was not checked against queue.maxdiskspace for disk assisted queues.
  • bugfix: linux kernel-like ratelimiter did not work properly with all inputs (for example, it did not work with imdup). The reason was that the PRI value was used, but that needed parsing of the message, which was done too late.
  • bugfix: disk queues created files in wrong working directory if the $WorkDirectory was changed multiple times, all queues only used the last value set.
  • bugfix: legacy directive $ActionQueueWorkerThreads was not honored
  • bugfix: segfault on startup when certain script constructs are used
  • e.g. "if not $msg …"
  • bugfix: imuxsock: UseSysTimeStamp config parameter did not work correctly
  • Thanks to Tomas Heinrich for alerting us and provinding a solution suggestion.
  • bugfix: $SystemLogUseSysTimeStamp/$SystemLogUsePIDFromSystem did not work
  • Thanks to Tomas Heinrich for the patch.
  • improved checking of queue config parameters on startup
  • bugfix: call to ruleset with async queue did not use the queue
  • closes: http://bugzilla.adiscon.com/show_bug.cgi?id=443
  • bugfix: if imtcp is loaded and no listeners are configured (which is uncommon), rsyslog crashes during shutdown.

New in rsyslog 8.1.2 (Dec 3, 2013)

  • Support for liblognorm1 added – results in performance improvements
  • Support for jemalloc added via –enable-jemalloc
  • Queue defaults have changed:
  • high water mark is now dynamically 90% of queue size
  • low water makr is now dynamically 70% of queue size
  • queue.discardMark is now dynamically 98% of queue size
  • queue.workerThreadMinimumMessage set to queue.size / num workers
  • For queues with very low queue.maxSize (< 100), "emergency" defaults will be used.
  • Note that build system is experimental at this stage.
  • Bugfix: disk queues created files in wrong working directory
  • if the $WorkDirectory was changed multiple times, all queues only used the last value set.
  • Bugfix: legacy directive $ActionQueueWorkerThreads was not honored
  • Bugfix: mmrfc5424addhmac: "key" parameter was not properly processed

New in rsyslog 7.4.6 (Dec 2, 2013)

  • bugfix: potential abort during HUP
  • This could happen when one of imklog, imzmq3, imkmsg, impstats,
  • imjournal, or imuxsock were under heavy load during a HUP.
  • closes: http://bugzilla.adiscon.com/show_bug.cgi?id=489
  • Thanks to Guy Rozendorn for reporting the problem and Peval Levhshin for
  • his analysis.
  • bugfix: imtcp flowControl parameter incorrectly defaulted to "off"
  • This could cause message loss on systems under heavy load and was
  • a change-of-behaviour to previous version. This is a regression
  • most probably introduced in 5.9.0 (but did not try hard to find the
  • exact point of its introduction).
  • now requires libestr 0.1.9 as earlier versions lead to problems with
  • number handling in RainerScript
  • bugfix: memory leak in strlen() RainerScript function
  • Thanks to Gregoire Seux for reportig this bug.
  • closes: http://bugzilla.adiscon.com/show_bug.cgi?id=486
  • bugfix: buffer overrun if re_extract function was called for submatch 50
  • Thanks to Pavel Levshin for reporting the problem and its location.
  • bugfix: memleak in re_extract() function
  • Thanks to Pavel Levshin for reporting this problem.
  • bugfix: potential abort in RainerScript optimizer
  • closes: http://bugzilla.adiscon.com/show_bug.cgi?id=488
  • Thanks to Thomas Doll for reporting the problem and Pavel Levshin for
  • fixing it.
  • bugfix: memory leak in omhiredis
  • Thanks to Pavel Levshin for the fix
  • bugfix: segfault if variable was assigned to non-container subtree
  • Thanks to Pavel Levshin for the fix

New in rsyslog 5.8.4 (Aug 10, 2011)

  • bugfix: potential misadressing in property replacer
  • bugfix: memcpy overflow can occur in allowed sender checking if a name is resolved to IPv4-mapped-on-IPv6 address
  • Found by Ismail Dömez at Suse
  • bugfix: MSGID corruption in RFC5424 parser under some circumstances
  • closes: http://bugzilla.adiscon.com/show_bug.cgi?id=275

New in rsyslog 6.3.3 (Jul 13, 2011)

  • This is a very important milestone release. It features the new configuration parser and thus provides the basis for a more intuitive configuration format.
  • Some enhancements were already made to the format.
  • More changes will come up with the next minor releases.

New in rsyslog 6.1.11 (Jul 11, 2011)

  • systemd support: set stdout/stderr to null – thx to Lennart for the patch
  • added support for the “:omusrmsg:” syntax in configuring user messages
  • added support for the “:omfile:” syntax in configuring user messages

New in rsyslog 6.3.2 (Jul 6, 2011)

  • added support for the “:omusrmsg:” syntax in configuring user messages systemd support: set stdout/stderr to null – thx to Lennart for the patch added support for obtaining timestamp for kernel message from message If the kernel time-stamps messages, time is now take from that timestamp instead of the system time when the message was read. This provides much better accuracy. Thanks to Lennart Poettering for suggesting this feature and his help during implementation.
  • added support for obtaining timestamp from system for imuxsock This permits to read the time a message was submitted to the system log socket. Most importantly, this is provided in microsecond resolution. So we are able to obtain high precision timestampis even for messages that were – as is usual – not formatted with them. This also simplifies things in regard to local time calculation in chroot environments. Many thanks to Lennart Poettering for suggesting this feature, providing some guidance on implementing it and coordinating getting the necessary support into the Linux kernel.
  • bugfix: timestamp was incorrectly calculated for timezones with minute offset
  • closes: http://bugzilla.adiscon.com/show_bug.cgi?id=271
  • bugfix: memory leak in imtcp & subsystems under some circumstances This leak is tied to error conditions which lead to incorrect cleanup of some data structures.

New in rsyslog 5.9.1 (Jul 1, 2011)

  • added support for obtaining timestamp for kernel message from message If the kernel time-stamps messages, time is now take from that timestamp instead of the system time when the message was read. This provides much better accuracy. Thanks to Lennart Poettering for suggesting this feature and his help during implementation.
  • added support for obtaining timestamp from system for imuxsock. This permits to read the time a message was submitted to the system log socket. Most importantly, this is provided in microsecond resolution. So we are able to obtain high precision timestampis even for messages that were – as is usual – not formatted with them. This also simplifies things in regard to local time calculation in chroot environments.
  • Many thanks to Lennart Poettering for suggesting this feature, providing some guidance on implementing it and coordinating getting the necessary support into the Linux kernel.
  • bugfix: timestamp was incorrectly calculated for timezones with minute offset
  • closes: http://bugzilla.adiscon.com/show_bug.cgi?id=271
  • bugfix: problems in failover action handling
  • closes: http://bugzilla.adiscon.com/show_bug.cgi?id=270
  • closes: http://bugzilla.adiscon.com/show_bug.cgi?id=254
  • bugfix: mutex was invalidly left unlocked during action processing At least one case where this can occur is during thread shutdown, which may be initiated by lower activity. In most cases, this is quite unlikely to happen. However, if it does, data structures may be corrupted which could lead to fatal failure and segfault. I detected
  • this via a testbench test, not a user report. But I assume that some users may have had unreproducable aborts that were cause by this bug.
  • bugfix: memory leak in imtcp & subsystems under some circumstances This leak is tied to error conditions which lead to incorrect cleanup of some data structures. [backport from v6]
  • bugfix/improvement:$WorkDirectory now gracefully handles trailing slashes

New in rsyslog 4.6.6 (Jun 24, 2011)

  • bugfix: memory leak in imtcp & subsystems under some circumstances
  • This leak is tied to error conditions which lead to incorrect cleanup
  • of some data structures. [backport from v6, limited testing under v4]
  • bugfix: invalid processing in QUEUE_FULL condition
  • If the the multi-submit interface was used and a QUEUE_FULL condition
  • occured, the failed message was properly destructed. However, the
  • rest of the input batch, if it existed, was not processed. So this
  • lead to potential loss of messages and a memory leak. The potential
  • loss of messages was IMHO minor, because they would have been dropped
  • in most cases due to the queue remaining full, but very few lucky ones
  • from the batch may have made it. Anyhow, this has now been changed so
  • that the rest of the batch is properly tried to be enqueued and, if
  • not possible, destructed.
  • bugfix: invalid storage type for config variables
  • bugfix: stream driver mode was not correctly set on tcp ouput on big
  • endian systems.
  • thanks varmojfekoj for the patch
  • bugfix: IPv6-address could not be specified in omrelp
  • this was due to improper parsing of “:”
  • closes: http://bugzilla.adiscon.com/show_bug.cgi?id=250
  • bugfix: memory and file descriptor leak in stream processing
  • Leaks could occur under some circumstances if the file stream handler
  • errored out during the open call. Among others, this could cause very
  • big memory leaks if there were a problem with unreadable disk queue
  • files. In regard to the memory leak, this
  • closes: http://bugzilla.adiscon.com/show_bug.cgi?id=256
  • bugfix: imfile potentially duplicates lines
  • This can happen when 0 bytes are read from the input file, and some
  • writer appends data to the file BEFORE we check if a rollover happens.
  • The check for rollover uses the inode and size as a criterion. So far,
  • we checked for equality of sizes, which is not given in this scenario,
  • but that does not indicate a rollover. From the source code comments:
  • Note that when we check the size, we MUST NOT check for equality.
  • The reason is that the file may have been written right after we
  • did try to read (so the file size has increased). That is NOT in
  • indicator of a rollover (this is an actual bug scenario we
  • experienced). So we need to check if the new size is smaller than
  • what we already have seen!
  • Also, under some circumstances an invalid truncation was detected. This
  • code has now been removed, a file change (and thus resent) is only
  • detected if the inode number changes.
  • bugfix: a couple of problems that imfile had on some platforms, namely
  • Ubuntu (not their fault, but occured there)
  • bugfix: imfile utilizes 32 bit to track offset. Most importantly,
  • this problem can not experienced on Fedora 64 bit OS (which has
  • 64 bit long’s!)
  • bugfix: abort if imfile reads file line of more than 64KiB
  • Thanks to Peter Eisentraut for reporting and analysing this problem.
  • bug tracker: http://bugzilla.adiscon.com/show_bug.cgi?id=221
  • bugfix: omlibdbi did not use password from rsyslog.con
  • closes: http://bugzilla.adiscon.com/show_bug.cgi?id=271
  • some improvements thanks to clang’s static code analyzer
  • overall cleanup (mostly unnecessary writes and otherwise unused stuff)
  • bugfix: fixed a very remote problem in msg.c which could occur when
  • running under extremely low memory conditions

New in rsyslog 6.1.10 (Jun 22, 2011)

  • problems in failover action handling
  • bugfix: mutex was invalidly left unlocked during action processing

New in rsyslog 6.1.9 (Jun 15, 2011)

  • bugfix: memory leak in imtcp & subsystems under some circumstances
  • This leak is tied to error conditions which lead to incorrect cleanup
  • of some data structures. [backport from v6.3]
  • bugfix: $ActionFileDefaultTemplate did not work
  • closes: http://bugzilla.adiscon.com/show_bug.cgi?id=262

New in rsyslog 5.9.0 (Jun 9, 2011)

  • This release starts a new development branch for version v5 which brings some new, not-so-intrusive features.
  • This release includes enhancements for imfile, support for TCP KEEP ALIVE, and a way to name actions (primarily for impstats).
  • Note that the main development activity is still focused at version 6, so this release is only for those interested in the minor enhancements to v5.

New in rsyslog 6.3.1 (Jun 7, 2011)

  • added a first implementation of a DNS name cache this still has a couple of weaknesses, like no expiration of entries, suboptimal algorithms — but it should perform much better than what we had previously. Implementation will be improved based on feedback during the next couple of releases

New in rsyslog 5.8.0 (Apr 12, 2011)

  • bugfix: race condition in deferred name resolution closes: http://bugzilla.adiscon.com/show_bug.cgi?id=238 Special thanks to Marcin for his persistence in helping to solve this bug.
  • bugfix: DA queue was never shutdown once it was started closes: http://bugzilla.adiscon.com/show_bug.cgi?id=241

New in rsyslog 5.7.10 (Mar 30, 2011)

  • This version has another set of fixes for some bugs that recently came in.
  • It also contains some non-intrusive enhancements, like example code that demonstrates how to write a strgen module that generates SQL statements.

New in rsyslog 5.7.9 (Mar 22, 2011)

  • improved testbench
  • among others, life tests for ommysql (against a test database) have been added, valgrind-based testing enhanced, …
  • enhance: fallback *at runtime* to epoll_create if epoll_create1 is not available. Thanks to Michael Biebl for analysis and patch!
  • bugfix: failover did not work correctly if repeated msg reduction was on
  • closes: http://bugzilla.adiscon.com/show_bug.cgi?id=236
  • affected directive was: $ActionExecOnlyWhenPreviousIsSuspended on
  • bugfix: minor memory leak in omlibdbi (< 1k per instance and run)
  • bugfix: (regression) omhdfs did no longer compile
  • bugfix: omlibdbi did not use password from rsyslog.conf
  • closes: http://bugzilla.adiscon.com/show_bug.cgi?id=203

New in rsyslog 5.6.5 (Mar 22, 2011)

  • bugfix: failover did not work correctly if repeated msg reduction was on
  • affected directive was: $ActionExecOnlyWhenPreviousIsSuspended on
  • bugfix: omlibdbi did not use password from rsyslog.con
  • closes: http://bugzilla.adiscon.com/show_bug.cgi?id=203
  • bugfix(kind of): tell users that config graph can currently not be
  • generated
  • closes: http://bugzilla.adiscon.com/show_bug.cgi?id=232
  • bugfix: discard action did not work under some circumstances
  • fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=217
  • (backport from 5.7.8)

New in rsyslog 5.6.4 (Mar 3, 2011)

  • # bugfix: potential abort condition when $RepeatedMsgReduction set to on as well as potentially in a number of other places where MsgDup() was used. This only happened when the imudp input module was used and it depended on name resolution not yet had taken place. In other words, this was a strange problem that could lead to hard to diagnose instability. So if you experience instability, chances are good that this fix will help.
  • # bugfix: fixed a memory leak and potential abort condition this could happen if multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=226
  • fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=218 # bugfix: memory leak when $RepeatedMsgReduction on was used bug tracker: http://bugzilla.adiscon.com/show_bug.cgi?id=225

New in rsyslog 6.1.4 (Feb 21, 2011)

  • bugfix/omhdfs: directive $OMHDFSFileName rendered unusable due to a search and replace-induced bug ;)
  • bugfix: minor race condition in action.c – considered cosmetic This is considered cosmetic as multiple threads tried to write exactly the same value into the same memory location without sync. The method has been changed so this can no longer happen.
  • added pmsnare parser module (written by David Lang)
  • enhanced imfile to support non-cancel input termination
  • improved systemd socket activation thanks to Marius Tomaschweski
  • improved error reporting for $WorkDirectory non-existance and other detectable problems are now reported, and the work directory is NOT set in this case
  • bugfix: pmsnare causded abort under some conditions
  • bugfix: abort if imfile reads file line of more than 64KiB Thanks to Peter Eisentraut for reporting and analysing this problem. bug tracker: http://bugzilla.adiscon.com/show_bug.cgi?id=221
  • bugfix: queue engine did not properly slow down inputs in FULL_DELAY mode when in disk-assisted mode. This especially affected imfile, which created unnecessarily queue files if a large set of input file data was to process.
  • bugfix: very long running actions could prevent shutdown under some circumstances. This has now been solved, at least for common situations.
  • bugfix: fixed compile problem due to empty structs this occured only on some platforms/compilers. thanks to Dražen Kačar for the fix

New in rsyslog 5.5.2 (Feb 5, 2010)

  • applied patches that make rsyslog compile under Apple OS X. Thanks to trey for providing these.
  • replaced data type "bool" by "sbool" because this created some portability issues.
  • added $Escape8BitCharactersOnReceive directive Thanks to David Lang for suggesting it.
  • worked around an issue where omfile failed to compile on32 bit platforms under some circumstances (this smells like a gcc problem, but a simple solution was available). Thanks to Kenneth Marshall for some advice.
  • extended testbench
  • bugfix: queues in direct mode could case a segfault, especially if an action failed for action queues. The issue was an invalid increment of a stack-based pointer which lead to destruction of the stack frame and thus a segfault on function return. Thanks to Michael Biebl for alerting us on this problem.
  • bugfix: hostname accidently set to IP address for some message sources, for example imudp. Thanks to Anton for reporting this bug. [imported v4]
  • bugfix: ompgsql had problems with transaction support, what actually rendered it unsuable. Thanks to forum user "horhe" for alerting me on this bug and helping to debug/fix it! [imported from 5.3.6]
  • bugfix: $CreateDirs variable not properly initialized, default thus was random (but most often "on") [imported from v3]

New in rsyslog 5.3.3 (Oct 27, 2009)

  • simplified and thus speeded up the queue engine, also fixed some potential race conditions (in very unusual shutdown conditions) along the way. The threading model has seriously changes, so there may be some regressions.
  • enhanced test environment (inlcuding testbench): support for enhancing probability of memory addressing failure by using non-NULL default value for malloced memory (optional, only if requested by configure option). This helps to track down some otherwise undetected issues within the testbench.
  • bugfix: potential abort if inputname property was not set primarily a problem of imdiag
  • bugfix: message processing states were not set correctly in all cases however, this had no negative effect, as the message processing state was not evaluated when a batch was deleted, and that was the only case where the state could be wrong.

New in rsyslog 5.3.1 (Oct 6, 2009)

  • This is a bug-fixing release, providing some important fixes from the v4-stable and the current v4-beta, like a bugfix for a potential segfault in stream writer on destruction.

New in rsyslog 5.3.0 (Sep 15, 2009)

  • This release starts a new v5-development branch.
  • It offers many new features like the use of epoll, when possible, in imudp, which provides greater performance and is a pilot to more such enhancements.
  • There are some bugfixes.
  • This is a recommended update for all users of the development branch.

New in rsyslog 5.1.5 (Sep 11, 2009)

  • This is the first public beta of the v5 branch.
  • As such, it is an important milestone on the way to an even more powerful rsyslogd.

New in rsyslog 3.20.5 (Apr 3, 2009)

  • bugfix: potential abort with DA queue after high watermark is reached There exists a race condition that can lead to a segfault. Thanks go to vbernetr, who performed the analysis and provided patch, which I only tweaked a very little bit.
  • fixed bugs in RainerScript: o when converting a number and a string to a common type, both were actually converted to the other variable's type. o the value of rsCStrConvertToNumber() was miscalculated. Thanks to varmojfekoj for the patch
  • fixed a bug in configure.ac which resulted in problems with environment detection - thanks to Michael Biebl for the patch
  • fixed a potential segfault problem in gssapi code thanks to varmojfekoj for the patch
  • doc enhance: provide standard template for MySQL module and instructions on how to modify schema

New in rsyslog 4.1.5 (Mar 11, 2009)

  • This version offers ERE support in filter conditions as well as the ability to optionally contain part of the repeated text in a "last message repeated n times" message.
  • Also, it fixes a bug that caused invalid parsing when receiving messages via UDP.
  • This is a recommended update for all development branch users.

New in rsyslog 3.21.10 (Feb 2, 2009)

  • This is a bug-fixing release.
  • Most importantly, a race that could result in a segfault in specific scenarios has been addressed.
  • Also, some command-line switches were incorrectly processed and a debug string was accidentally written to stdout on daemon termination.
  • This is a recommended update for all users of the beta branch.

New in rsyslog 4.1.4 (Jan 29, 2009)

  • This is primarily a stability update.
  • Most importantly, this version addresses a potential segfault that occurred rather infrequently, and primarily on very fast and busy systems.
  • The only other change is a fix for the $PreserveFQDN config directive, which did not properly affect locally emitted messages.
  • This is a recommended update for all users of the development branch.

New in rsyslog 4.1.3 (Jan 23, 2009)

  • added $InputTCPServerAddtlFrameDelimiter config directive, which enables to specify an additional, non-standard message delimiter for processing plain tcp syslog. This is primarily a fix for the invalid framing used in Juniper's NetScreen products. Credit to forum user Arv for suggesting this solution.
  • added $InputTCPServerInputName property, which enables a name to be specified that will be available during message processing in the inputname property. This is considered useful for logic that treats messages differently depending on which input received them.
  • added $PreserveFQDN config file directive Enables to use FQDNs in sender names where the legacy default would have stripped the domain part. Thanks to BlinkMind, Inc. http://www.blinkmind.com for sponsoring this development.
  • bugfix: imudp went into an endless loop under some circumstances (but could also leave it under some other circumstances...) Thanks to David Lang and speedfox for reporting this issue.

New in rsyslog 3.21.8 (Dec 4, 2008)

  • security bugfix: $AllowedSender was not honored, all senders were permitted instead (see security advisory)
  • bugfix: imklog did not compile on FreeBSD
  • merged in all other changes from 3.20.1 (see there)

New in rsyslog 3.20.1 (Dec 4, 2008)

  • security bugfix: $AllowedSender was not honoured, all senders were permitted instead (see security advisory)
  • enhance: regex nomatch option "ZERO" has been added This allows to return the string 0 if a regular expression is not found. This is probably useful for storing numerical values into database columns.
  • bugfix: memory leak in gtls netstream driver fixed memory was lost each time a TLS session was torn down. This could result in a considerable memory leak if it happened quite frequently (potential system crash condition)
  • doc update: documented how to specify multiple property replacer options + link to new online regex generator tool added
  • minor bufgfix: very small memory leak in gtls netstream driver around a handful of bytes (< 20) for each HUP
  • improved debug output for regular expressions inside property replacer RE's seem to be a big trouble spot and I would like to have more information inside the debug log. So I decided to add some additional debug strings permanently.

New in rsyslog 4.1.0 (Nov 19, 2008)

  • This release contains many enhancements that allow the engine to process many more events per second than any previous version.
  • This was made possible thanks to large changes inside the rsyslog core.
  • Consequently, there is ample room for bugs, so this version should be used with care.
  • Note that it also contains some additional bugfixes and small feature enhancements that are not found in other versions.

New in rsyslog 3.21.7 Beta (Nov 11, 2008)

  • This version brings all features of the current development to the beta branch.
  • It also contains one new addition: the ability to replace a not found regular expression match with a zero.
  • This can be useful for storing numerical values into databases.
  • This is a recommended update for all beta branch users.

New in rsyslog 3.20.0 (Nov 5, 2008)

  • This is the next iteration of the v3-stable branch. Most importantly, TLS support is now also available in the stable branch.
  • This version includes all features of the current beta plus a bugfix.
  • For users of the v3-stable branch, it brings many feature enhancements.
  • This is a recommended update for all v3-stable branch users.

New in rsyslog 3.21.5 Beta (Sep 30, 2008)

  • performance optimization: unnecessary time() calls during message parsing removed - thanks to David Lang for his excellent performance analysis
  • added new capability to property replacer: multiple immediately successive field delimiters are treated as a single one. Thanks to Zhuang Yuyao for the patch.
  • added message property "inputname", which contains the name of the input (module) that generated it. Presence is depending on suport in each input module (else it is blank).
  • added system property "$myhostname", which contains the name of the local host as it knows itself.
  • imported a number of fixes and enhancements from the stable and devel branches, including a fix to a potential segfault on HUP when using UDP listners
  • re-enabled gcc builtin atomic operations and added a proper ./configure check
  • bugfix: potential race condition when adding messages to queue There was a wrong order of mutex lock operations. It is hard to believe that really caused problems, but in theory it could and with threading we often see that theory becomes practice if something is only used long enough on a fast enough machine with enough CPUs
  • cleaned up internal debug system code and made it behave better in regard to multi-threading

New in rsyslog 3.18.4 (Sep 18, 2008)

  • This version contains a number of fixes.
  • Most importantly, one bug that could cause undesired message discarding when the queue is nearly full was fixed.
  • This was caused by an invalid default enabling of discard-on-queue-full when this was not explicitly configured.
  • All users of the v3-stable branch are advised to update to this release.