Rsyslog 7.3.5

v7.1.10 [10-12-12]

• bugfix: m4 directory was not present in release tarball
• bugfix: small memory leak with string-type templates
• bugfix: small memory leak when template was specified in omfile
• bugfix: some config processing warning messages were treated as errors
• bugfix: small memory leak when processing action() statements
• bugfix: unknown action() parameters were not reported

v7.1.1 [09-12-12]

• MAJOR NEW FEATURE: rulengine now fully supports nesting
  including if … then … else … constructs. This is a big change
  and it obviously has a lot of bug potential.
• BSD-style (filter) blocks are no longer supported
  see http://www.rsyslog.com/g/BSD for details and solution
• imuxsock now stores trusted properties by default in the CEE root
  This was done in order to keep compatible with other implementations of
  the lumberjack schema
  Thanks to Miloslav Trmač for pointing to this.
• bugfix: string-generating templates caused abort if CEE field could not
  be found

v6.3.12 [07-10-12]

• support for elasticsearch via omelasticsearch added
  Note that this module has been tested quite well by a number of folks, and this is why we merge in new functionality in a late beta stage. Even if problems would exist, only users of omelasticsearch would experience them, making it a pretty safe addition.
• bugfix: $ActionName was not properly honored
  Thanks to Abby Edwards for alerting us

v5.8.6 [10-27-11]

• bugfix: missing whitespace after property-based filter was not detected
• bugfix: $OMFileFlushInterval period was doubled – now using correct value
• bugfix: ActionQueue could malfunction due to index error
  Thanks to Vlad Grigorescu for the patch
• bugfix: $ActionExecOnlyOnce interval did not work properly
  Thanks to Tomas Heinrich for the patch
• bugfix: race condition when extracting program name, APPNAME, structured data and PROCID (RFC5424 fields) could lead to invalid characters e.g. in dynamic file names or during forwarding (general malfunction of these fields in templates, mostly under heavy load)
• bugfix: imuxsock did no longer ignore message-provided timestamp, if so configured (the *default*). Lead to no longer sub-second timestamps.
  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=281
• bugfix: omfile returns fatal error code for things that go really wrong previously, RS_RET_RESUME was returned, which lead to a loop inside the rule engine as omfile could not really recover.
• bugfix: imfile did invalid system call under some circumstances when a file that was to be monitored did not exist BUT the state file actually existed. Mostly a cosmetic issue. Root cause was incomplete error checking in stream.c; so patch may affect other code areas.
• bugfix: rsyslogd -v always said 64 atomics were not present
  Thanks to mono_matsuko for the patch

v6.3.6 [09-20-11]

• added $InputRELPServerBindRuleset directive to specify rulesets for RELP
• bugfix: config parser did not support properties with dashes in them inside property-based filters. Thanks to Gerrit Seré for reporting this.

v6.3.3 [07-15-11]

• rsyslog.conf format: now parsed by RainerScript parser
  this provides the necessary base for future enhancements as well as some
  minor immediate ones. For details see: http://blog.gerhards.net/2011/07/rsyslog-633-config-format-improvements.html
• performance of script-based filters notably increased
• removed compatibility mode as we expect people have adjusted their
  confs by now
• added support for the “:omfile:” syntax for actions
  Tags: 6.3.3, conf, devel, format, parser, rainerscript, v6
  Posted in Changelog | 1 Comment » Changelog for 6.1.11 (v6-beta) Monday, July 11th, 2011 Version 6.1.11 [BETA] (rgerhards), 2011-07-11
  • systemd support: set stdout/stderr to null – thx to Lennart for the patch
  • added support for the “:omusrmsg:” syntax in configuring user messages
  • added support for the “:omfile:” syntax in configuring user messages
    Tags: 6.1.1, beta, Changelog, v6
    Posted in Changelog | 1 Comment » Changelog for 5.9.2 (v5-devel) Monday, July 11th, 2011 Version 5.9.2 [V5-DEVEL] (rgerhards), 2011-07-11
    • systemd support: set stdout/stderr to null – thx to Lennart for the patch
    • added support for the “:omusrmsg:” syntax in configuring user messages
    • added support for the “:omfile:” syntax in configuring user messages
      Tags: 5.9.2, Changelog, devel, v5
      Posted in Changelog | 1 Comment » Changelog for 4.6.7 (v4-stable) Monday, July 11th, 2011 Version 4.6.7 [v4-stable] (rgerhards), 2011-07-11
      • added support for the “:omusrmsg:” syntax in configuring user messages
      • added support for the “:omfile:” syntax in configuring user messages
        Tags: 4.6.7, Changelog, stable, v4
        Posted in Changelog | 1 Comment » Changelog for 5.8.3 (v5-stable) Monday, July 11th, 2011 Version 5.8.3 [V5-stable] (rgerhards), 2011-07-11
        • systemd support: set stdout/stderr to null – thx to Lennart for the patch
        • added support for the “:omusrmsg:” syntax in configuring user messages
        • added support for the “:omfile:” syntax in configuring user messages
          Note: previous outchannel syntax will generate a warning message. This
          may be surprising to some users, but it is quite urgent to alert them
          of the new syntax as v6 can no longer support the previous one. Tags: 5.8.3, Changelog, stable, v5
          Posted in Changelog | 1 Comment » Changelog for 4.7.4 (v4-beta) Monday, July 11th, 2011 Version 4.7.4 [v4-beta] (rgerhards), 2011-07-11
          • added support for the “:omusrmsg:” syntax in configuring user messages
          • added support for the “:omfile:” syntax in configuring user messages
          • added $LocalHostName config directive
          • bugfix: PRI was invalid on Solaris for message from local log socket
          • bugfix: local hostname was pulled too-early, so that some config
            directives (namely FQDN settings) did not have any effect
          • bugfix: atomic increment for msg object may not work correct on all
            platforms. Thanks to Chris Metcalf for the patch
          • bugfix: a slightly more informative error message when a TCP
            connections is aborted Tags: 4.7.4, beta, Changelog, v4
            Posted in Changelog | 1 Comment » Changelog for 6.3.2 (v6-devel) Wednesday, July 6th, 2011 Version 6.3.2 [DEVEL] (rgerhards), 2011-07-06
            • added support for the “:omusrmsg:” syntax in configuring user messages
            • systemd support: set stdout/stderr to null – thx to Lennart for the patch
            • added support for obtaining timestamp for kernel message from message
              If the kernel time-stamps messages, time is now take from that
              timestamp instead of the system time when the message was read. This
              provides much better accuracy. Thanks to Lennart Poettering for
              suggesting this feature and his help during implementation.
            • added support for obtaining timestamp from system for imuxsock
              This permits to read the time a message was submitted to the system
              log socket. Most importantly, this is provided in microsecond resolution.
              So we are able to obtain high precision timestampis even for messages
              that were – as is usual – not formatted with them. This also simplifies
              things in regard to local time calculation in chroot environments.
              Many thanks to Lennart Poettering for suggesting this feature,
              providing some guidance on implementing it and coordinating getting the
              necessary support into the Linux kernel.
            • bugfix: timestamp was incorrectly calculated for timezones with minute
              offset
              closes: http://bugzilla.adiscon.com/show_bug.cgi?id=271
            • bugfix: memory leak in imtcp & subsystems under some circumstances
              This leak is tied to error conditions which lead to incorrect cleanup
              of some data structures. Tags: 6.3.2, Changelog, devel, v6
              Posted in Changelog | 1 Comment » Changelog for 5.9.1 (v5-devel) Thursday, June 30th, 2011 Version 5.9.1 [V5-DEVEL] (rgerhards), 2011-06-30
              • added support for obtaining timestamp for kernel message from message
                If the kernel time-stamps messages, time is now take from that
                timestamp instead of the system time when the message was read. This
                provides much better accuracy. Thanks to Lennart Poettering for
                suggesting this feature and his help during implementation.
              • added support for obtaining timestamp from system for imuxsock
                This permits to read the time a message was submitted to the system
                log socket. Most importantly, this is provided in microsecond resolution.
                So we are able to obtain high precision timestampis even for messages
                that were – as is usual – not formatted with them. This also simplifies
                things in regard to local time calculation in chroot environments.
                Many thanks to Lennart Poettering for suggesting this feature,
                providing some guidance on implementing it and coordinating getting the
                necessary support into the Linux kernel.
              • bugfix: timestamp was incorrectly calculated for timezones with minute
                offset
                closes: http://bugzilla.adiscon.com/show_bug.cgi?id=271
              • bugfix: problems in failover action handling
                closes: http://bugzilla.adiscon.com/show_bug.cgi?id=270
                closes: http://bugzilla.adiscon.com/show_bug.cgi?id=254
              • bugfix: mutex was invalidly left unlocked during action processing
                At least one case where this can occur is during thread shutdown, which
                may be initiated by lower activity. In most cases, this is quite
                unlikely to happen. However, if it does, data structures may be
                corrupted which could lead to fatal failure and segfault. I detected
                this via a testbench test, not a user report. But I assume that some
                users may have had unreproducable aborts that were cause by this bug.
              • bugfix: memory leak in imtcp & subsystems under some circumstances
                This leak is tied to error conditions which lead to incorrect cleanup
                of some data structures. [backport from v6]
              • bugfix/improvement:$WorkDirectory now gracefully handles trailing slashes
                Tags: 5.9.1, Changelog, v5
                Posted in Changelog | 1 Comment » Changelog for 4.6.6 (v4-stable) Friday, June 24th, 2011 Version 4.6.6 [v4-stable] (rgerhards), 2011-06-24
                • bugfix: memory leak in imtcp & subsystems under some circumstances
                  This leak is tied to error conditions which lead to incorrect cleanup
                  of some data structures. [backport from v6, limited testing under v4]
                • bugfix: invalid processing in QUEUE_FULL condition
                  If the the multi-submit interface was used and a QUEUE_FULL condition
                  occured, the failed message was properly destructed. However, the
                  rest of the input batch, if it existed, was not processed. So this
                  lead to potential loss of messages and a memory leak. The potential
                  loss of messages was IMHO minor, because they would have been dropped
                  in most cases due to the queue remaining full, but very few lucky ones
                  from the batch may have made it. Anyhow, this has now been changed so
                  that the rest of the batch is properly tried to be enqueued and, if
                  not possible, destructed.
                • bugfix: invalid storage type for config variables
                • bugfix: stream driver mode was not correctly set on tcp ouput on big
                  endian systems.
                  thanks varmojfekoj for the patch
                • bugfix: IPv6-address could not be specified in omrelp
                  this was due to improper parsing of “:”
                  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=250
                • bugfix: memory and file descriptor leak in stream processing
                  Leaks could occur under some circumstances if the file stream handler
                  errored out during the open call. Among others, this could cause very
                  big memory leaks if there were a problem with unreadable disk queue
                  files. In regard to the memory leak, this
                  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=256
                • bugfix: imfile potentially duplicates lines
                  This can happen when 0 bytes are read from the input file, and some
                  writer appends data to the file BEFORE we check if a rollover happens.
                  The check for rollover uses the inode and size as a criterion. So far,
                  we checked for equality of sizes, which is not given in this scenario,
                  but that does not indicate a rollover. From the source code comments:
                  Note that when we check the size, we MUST NOT check for equality.
                  The reason is that the file may have been written right after we
                  did try to read (so the file size has increased). That is NOT in
                  indicator of a rollover (this is an actual bug scenario we
                  experienced). So we need to check if the new size is smaller than
                  what we already have seen!
                  Also, under some circumstances an invalid truncation was detected. This
                  code has now been removed, a file change (and thus resent) is only
                  detected if the inode number changes.
                • bugfix: a couple of problems that imfile had on some platforms, namely
                  Ubuntu (not their fault, but occured there)
                • bugfix: imfile utilizes 32 bit to track offset. Most importantly,
                  this problem can not experienced on Fedora 64 bit OS (which has
                  64 bit long’s!)
                • bugfix: abort if imfile reads file line of more than 64KiB
                  Thanks to Peter Eisentraut for reporting and analysing this problem.
                  bug tracker: http://bugzilla.adiscon.com/show_bug.cgi?id=221
                • bugfix: omlibdbi did not use password from rsyslog.con
                  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=271
                • some improvements thanks to clang’s static code analyzer
                  • overall cleanup (mostly unnecessary writes and otherwise unused stuff)
                  • bugfix: fixed a very remote problem in msg.c which could occur when
                    running under extremely low memory conditions

v6.1.9 [06-19-11]

• bugfix: memory leak in imtcp & subsystems under some circumstances
  This leak is tied to error conditions which lead to incorrect cleanup
  of some data structures. [backport from v6.3]
• bugfix: $ActionFileDefaultTemplate did not work
  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=262
  Tags: 6.1.9, Changelog, rsyslog
  Posted in Changelog | 1 Comment » Changelog for 5.9.0 (v5-devel) Wednesday, June 8th, 2011 Version 5.9.0 [V5-DEVEL] (rgerhards), 2011-06-08
  • imfile: added $InputFileMaxLinesAtOnce directive
  • enhanced imfile to support input batching
  • added capability for imtcp and imptcp to activate keep-alive packets
    at the socket layer. This has not been added to imttcp, as the latter is
    only an experimental module, and one which did not prove to be useful.
    reference: http://kb.monitorware.com/post20791.html
  • added support to control KEEPALIVE settings in imptcp
    this has not yet been added to imtcp, but could be done on request.
  • $ActionName is now also used for naming of queues in impstats
    as well as in the debug output
  • bugfix: do not open files with full privileges, if privs will be dropped
    This make the privilege drop code more bulletproof, but breaks Ubuntu’s
    work-around for log files created by external programs with the wrong
    user and/or group. Note that it was long said that this “functionality”
    would break once we go for serious privilege drop code, so hopefully
    nobody still depends on it (and, if so, they lost…).
  • bugfix: pipes not opened in full priv mode when privs are to be dropped
  • this begins a new devel branch for v5
  • better handling of queue i/o errors in disk queues. This is kind of a
    bugfix, but a very intrusive one, this it goes into the devel version
    first. Right now, “file not found” is handled and leads to the new
    emergency mode, in which disk action is stopped and the queue run
    in direct mode. An error message is emited if this happens.
  • added support for user-level PRI provided via systemd
  • added new config directive $InputTCPFlowControl to select if tcp
    received messages shall be flagged as light delayable or not.
  • enhanced omhdfs to support batching mode. This permits to increase
    performance, as we now call the HDFS API with much larger message
    sizes and far more infrequently
  • bugfix: failover did not work correctly if repeated msg reduction was on
    affected directive was: $ActionExecOnlyWhenPreviousIsSuspended on
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=236 Tags: 5.9.0, Changelog, devel, rsyslog, v5
    Posted in Changelog | 1 Comment » Changelog for 6.3.1 (devel) Tuesday, June 7th, 2011 Version 6.3.1  [DEVEL] (rgerhards), 2011-06-07
    • added a first implementation of a DNS name cache this still has a couple of weaknesses, like no expiration of entries, suboptimal algorithms — but it should perform much better than what we had previously. Implementation will be improved based on feedback during the next couple of releases

v6.1.8 [05-21-11]

• official new beta version (note that in a sense 6.1.7 was already beta,
  so we may release the first stable v6 earlier than usual)
• new module mmsnmptrapd, a sample message modification module
• import of minor bug fixes from v4 & v5
  Tags: 6.1.8, beta, rsyslog
  Posted in Changelog | 1 Comment » Changelog for 5.8.1 (v5-stable) Thursday, May 19th, 2011 Version 5.8.1 [V5-stable] (rgerhards), 2011-05-19
  • bugfix: invalid processing in QUEUE_FULL condition
    If the the multi-submit interface was used and a QUEUE_FULL condition
    occured, the failed message was properly destructed. However, the
    rest of the input batch, if it existed, was not processed. So this
    lead to potential loss of messages and a memory leak. The potential
    loss of messages was IMHO minor, because they would have been dropped
    in most cases due to the queue remaining full, but very few lucky ones
    from the batch may have made it. Anyhow, this has now been changed so
    that the rest of the batch is properly tried to be enqueued and, if
    not possible, destructed.
  • new module mmsnmptrapd, a sample message modification module
    This can be useful to reformat snmptrapd messages and also serves as
    a sample for how to write message modification modules using the
    output module interface. Note that we introduced this new
    functionality directly into the stable release, as it does not
    modify the core and as such cannot have any side-effects if it is
    not used (and thus the risk is solely on users requiring that
    functionality).
  • bugfix: rate-limiting inside imuxsock did not work 100% correct
    reason was that a global config variable was invalidly accessed where a
    listener variable should have been used.
    Also performance-improved the case when rate limiting is turned off (this
    is a very unintrusive change, thus done directly to the stable version).
  • bugfix: $myhostname not available in RainerScript (and no error message)
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=233
  • bugfix: memory and file descriptor leak in stream processing
    Leaks could occur under some circumstances if the file stream handler
    errored out during the open call. Among others, this could cause very
    big memory leaks if there were a problem with unreadable disk queue
    files. In regard to the memory leak, this
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=256
  • bugfix: doc for impstats had wrong config statements
    also, config statements were named a bit inconsistent, resolved that
    problem by introducing an alias and only documenting the consistent
    statements
    Thanks to Marcin for bringing up this problem.
  • bugfix: IPv6-address could not be specified in omrelp
    this was due to improper parsing of “:”
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=250
  • bugfix: TCP connection invalidly aborted when messages needed to be
    discarded (due to QUEUE_FULL or similar problem)
  • bugfix: $LocalHostName was not honored under all circumstances
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=258
  • bugfix(minor): improper template function call in syslogd.c
    Tags: 5.8.1, Changelog, rsyslog, stable, v5
    Posted in Changelog | 1 Comment » Changelog for 6.1.7 (v6-devel) Friday, April 15th, 2011 Version 6.1.7 [DEVEL] (rgerhards), 2011-04-15
    • added log classification capabilities (via mmnormalize & tags)
    • speeded up tcp forwarding by reducing number of API calls
      this especially speeds up TLS processing
    • somewhat improved documentation index
    • bugfix: enhanced imudp config processing code disabled due to wrong
      merge (affected UDP realtime capabilities)
    • bugfix (kind of): memory leak with tcp reception epoll handler
      This was an extremely unlikely leak and, if it happend, quite small.
      Still it is better to handle this border case.
    • bugfix: IPv6-address could not be specified in omrelp
      this was due to improper parsing of “:”
      closes: http://bugzilla.adiscon.com/show_bug.cgi?id=250

v5.8.1 [05-20-11]

• bugfix: invalid processing in QUEUE_FULL condition
  If the the multi-submit interface was used and a QUEUE_FULL condition
  occured, the failed message was properly destructed. However, the
  rest of the input batch, if it existed, was not processed. So this
  lead to potential loss of messages and a memory leak. The potential
  loss of messages was IMHO minor, because they would have been dropped
  in most cases due to the queue remaining full, but very few lucky ones
  from the batch may have made it. Anyhow, this has now been changed so
  that the rest of the batch is properly tried to be enqueued and, if
  not possible, destructed.
• new module mmsnmptrapd, a sample message modification module
  This can be useful to reformat snmptrapd messages and also serves as
  a sample for how to write message modification modules using the
  output module interface. Note that we introduced this new
  functionality directly into the stable release, as it does not
  modify the core and as such cannot have any side-effects if it is
  not used (and thus the risk is solely on users requiring that
  functionality).
• bugfix: rate-limiting inside imuxsock did not work 100% correct
  reason was that a global config variable was invalidly accessed where a
  listener variable should have been used.
  Also performance-improved the case when rate limiting is turned off (this
  is a very unintrusive change, thus done directly to the stable version).
• bugfix: $myhostname not available in RainerScript (and no error message)
  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=233
• bugfix: memory and file descriptor leak in stream processing
  Leaks could occur under some circumstances if the file stream handler
  errored out during the open call. Among others, this could cause very
  big memory leaks if there were a problem with unreadable disk queue
  files. In regard to the memory leak, this
  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=256
• bugfix: doc for impstats had wrong config statements
  also, config statements were named a bit inconsistent, resolved that
  problem by introducing an alias and only documenting the consistent
  statements
  Thanks to Marcin for bringing up this problem.
• bugfix: IPv6-address could not be specified in omrelp
  this was due to improper parsing of “:”
  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=250
• bugfix: TCP connection invalidly aborted when messages needed to be
  discarded (due to QUEUE_FULL or similar problem)
• bugfix: $LocalHostName was not honored under all circumstances
  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=258
• bugfix(minor): improper template function call in syslogd.c
  Tags: 5.8.1, Changelog, rsyslog, stable, v5
  Posted in Changelog | 1 Comment » Changelog for 6.1.7 (v6-devel) Friday, April 15th, 2011 Version 6.1.7 [DEVEL] (rgerhards), 2011-04-15
  • added log classification capabilities (via mmnormalize & tags)
  • speeded up tcp forwarding by reducing number of API calls
    this especially speeds up TLS processing
  • somewhat improved documentation index
  • bugfix: enhanced imudp config processing code disabled due to wrong
    merge (affected UDP realtime capabilities)
  • bugfix (kind of): memory leak with tcp reception epoll handler
    This was an extremely unlikely leak and, if it happend, quite small.
    Still it is better to handle this border case.
  • bugfix: IPv6-address could not be specified in omrelp
    this was due to improper parsing of “:”
    closes: http://bugzilla.adiscon.com/show_bug.cgi?id=250

v6.1.7 [04-19-11]

• added log classification capabilities (via mmnormalize & tags)
• speeded up tcp forwarding by reducing number of API calls
  this especially speeds up TLS processing
• somewhat improved documentation index
• bugfix: enhanced imudp config processing code disabled due to wrong
  merge (affected UDP realtime capabilities)
• bugfix (kind of): memory leak with tcp reception epoll handler
  This was an extremely unlikely leak and, if it happend, quite small.
  Still it is better to handle this border case.
• bugfix: IPv6-address could not be specified in omrelp
  this was due to improper parsing of “:”
  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=250

v5.8.0 [04-13-11]

• bugfix: race condition in deferred name resolution
  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=238
  Special thanks to Marcin for his persistence in helping to solve this
  bug.
• bugfix: DA queue was never shutdown once it was started
  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=241

v5.7.10 [04-03-11]

• bugfix: ompgsql did not work properly with ANSI SQL strings
  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=229
• bugfix: rsyslog did not build with –disable-regexp configure option
  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=243
• bugfix: PRI was invalid on Solaris for message from local log socket
• enhance: added $BOM system property to ease writing byte order masks
• bugfix: RFC5424 parser confused by empty structured data
  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=237
• bugfix: error return from strgen caused abort, now causes action to be
  ignored (just like a failed filter)
• new sample plugin for a strgen to generate sql statement consumable
  by a database plugin
• bugfix: strgen could not be used together with database outputs
  because the sql/stdsql option could not be specified. This has been
  solved by permitting the strgen to include the opton inside its name.
  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=195

v5.6.5 [03-23-11]

• bugfix: failover did not work correctly if repeated msg reduction was on
  affected directive was: $ActionExecOnlyWhenPreviousIsSuspended on
• bugfix: omlibdbi did not use password from rsyslog.con
  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=203
• bugfix(kind of): tell users that config graph can currently not be
  generated
  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=232
• bugfix: discard action did not work under some circumstances
  fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=217
  (backport from 5.7.8)

v5.7.9 [03-18-11]

• improved testbench
  among others, life tests for ommysql (against a test database) have been added, valgrind-based testing enhanced, …
• enhance: fallback *at runtime* to epoll_create if epoll_create1 is not available. Thanks to Michael Biebl for analysis and patch!
• bugfix: failover did not work correctly if repeated msg reduction was on
  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=236
  affected directive was: $ActionExecOnlyWhenPreviousIsSuspended on
• bugfix: minor memory leak in omlibdbi (< 1k per instance and run)
• bugfix: (regression) omhdfs did no longer compile
• bugfix: omlibdbi did not use password from rsyslog.conf
  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=203

v6.1.6 [03-15-11]

• enhanced omhdfs to support batching mode. This permits to increase
  performance, as we now call the HDFS API with much larger message
  sizes and far more infrequently
• improved testbench
  among others, life tests for ommysql (against a test database) have
  been added, valgrind-based testing enhanced, …
• bugfix: minor memory leak in omlibdbi (< 1k per instance and run)
• bugfix: (regression) omhdfs did no longer compile
• bugfix: omlibdbi did not use password from rsyslog.con
  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=203
• systemd support somewhat improved (can now take over existing log sockt)
• bugfix: discard action did not work under some circumstances
  fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=217
• bugfix: file descriptor leak in gnutls netstream driver
  fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=222
• fixed compile problem in imtemplate
  fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=235 Tags: 6.1.6, Changelog, devel, v6
  Posted in Changelog | 1 Comment » Changelog for 5.7.8 (v5-beta) Wednesday, March 9th, 2011 Version 5.7.8 [V5-BETA] (rgerhards), 2011-03-09
  • systemd support somewhat improved (can now take over existing log sockt)
  • bugfix: discard action did not work under some circumstances
    fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=217
  • bugfix: file descriptor leak in gnutls netstream driver
    fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=222

v5.7.8 [03-11-11]

• systemd support somewhat improved (can now take over existing log sockt)
• bugfix: discard action did not work under some circumstances
  fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=217
• bugfix: file descriptor leak in gnutls netstream driver
  fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=222

v6.1.5 [03-05-11]

• improved testbench
• enhanced imtcp to use a pool of worker threads to process incoming
  messages. This enables higher processing rates, especially in the TLS
  case (where more CPU is needed for the crypto functions)
• added support for TLS (in anon mode) to tcpflood
• improved TLS error reporting
• improved TLS startup (Diffie-Hellman bits do not need to be generated,
  as we do not support full anon key exchange — we always need certs)
• bugfix: fixed a memory leak and potential abort condition
  this could happen if multiple rulesets were used and some output batches
  contained messages belonging to more than one ruleset.
  fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=226
  fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=218
• bugfix: memory leak when $RepeatedMsgReduction on was used
  bug tracker: http://bugzilla.adiscon.com/show_bug.cgi?id=225
• bugfix: potential abort condition when $RepeatedMsgReduction set to on
  as well as potentially in a number of other places where MsgDup() was
  used. This only happened when the imudp input module was used and it
  depended on name resolution not yet had taken place. In other words,
  this was a strange problem that could lead to hard to diagnose
  instability. So if you experience instability, chances are good that
  this fix will help.

v5.7.7 [03-03-11]

• bugfix: potential abort condition when $RepeatedMsgReduction set to on as well as potentially in a number of other places where MsgDup() was used. This only happened when the imudp input module was used and it depended on name resolution not yet had taken place. In other words, this was a strange problem that could lead to hard to diagnose instability. So if you experience instability, chances are good that this fix will help.

v5.7.6 [02-27-11]

• bugfix: fixed a memory leak and potential abort condition
  this could happen if multiple rulesets were used and some output batches
  contained messages belonging to more than one ruleset.
  fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=226
  fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=218
• bugfix: memory leak when $RepeatedMsgReduction on was used
  bug tracker: http://bugzilla.adiscon.com/show_bug.cgi?id=225

v5.7.5 [02-24-11]

• enhance: imfile did not yet support multiple rulesets, now added
  we do this directly in the beta because a) it does not affect existing
  functionality and b) one may argue that this missing functionality is
  close to a bug.
• improved testbench, added tests for imuxsock
• bugfix: imuxsock did no longer sanitize received messages
  This was a regression from the imuxsock partial rewrite. Happened
  because the message is no longer run through the standard parsers.
  bug tracker: http://bugzilla.adiscon.com/show_bug.cgi?id=224
• bugfix: minor race condition in action.c – considered cosmetic
  This is considered cosmetic as multiple threads tried to write exactly
  the same value into the same memory location without sync. The method
  has been changed so this can no longer happen.

v6.1.4 [02-19-11]

• bugfix/omhdfs: directive $OMHDFSFileName rendered unusable
  due to a search and replace-induced bug ;)
• bugfix: minor race condition in action.c – considered cosmetic
  This is considered cosmetic as multiple threads tried to write exactly
  the same value into the same memory location without sync. The method
  has been changed so this can no longer happen.
• added pmsnare parser module (written by David Lang)
• enhanced imfile to support non-cancel input termination
• improved systemd socket activation thanks to Marius Tomaschweski
• improved error reporting for $WorkDirectory
  non-existance and other detectable problems are now reported,
  and the work directory is NOT set in this case
• bugfix: pmsnare causded abort under some conditions
• bugfix: abort if imfile reads file line of more than 64KiB
  Thanks to Peter Eisentraut for reporting and analysing this problem.
  bug tracker: http://bugzilla.adiscon.com/show_bug.cgi?id=221
• bugfix: queue engine did not properly slow down inputs in FULL_DELAY mode
  when in disk-assisted mode. This especially affected imfile, which
  created unnecessarily queue files if a large set of input file data was
  to process.
• bugfix: very long running actions could prevent shutdown under some
  circumstances. This has now been solved, at least for common
  situations.
• bugfix: fixed compile problem due to empty structs
  this occured only on some platforms/compilers. thanks to Dražen Kačar
  for the fix

v5.7.4 [02-18-11]

• added pmsnare parser module (written by David Lang)
• enhanced imfile to support non-cancel input termination
• improved systemd socket activation thanks to Marius Tomaschweski
• improved error reporting for $WorkDirectory
  non-existance and other detectable problems are now reported,
  and the work directory is NOT set in this case
• bugfix: pmsnare causded abort under some conditions
• bugfix: abort if imfile reads file line of more than 64KiB
  Thanks to Peter Eisentraut for reporting and analysing this problem.
  bug tracker: http://bugzilla.adiscon.com/show_bug.cgi?id=221
• bugfix: queue engine did not properly slow down inputs in FULL_DELAY mode
  when in disk-assisted mode. This especially affected imfile, which
  created unnecessarily queue files if a large set of input file data was
  to process.
• bugfix: very long running actions could prevent shutdown under some
  circumstances. This has now been solved, at least for common
  situations.
• bugfix: fixed compile problem due to empty structs
  this occured only on some platforms/compilers. thanks to Dražen Kačar
  for the fix

v5.7.3 [02-11-11]

• added support for processing multi-line messages in imfile
  thanks to David Lang for implementing this
• added $IMUDPSchedulingPolicy and $IMUDPSchedulingPriority config settings
• added $LocalHostName config directive
• bugfix: fixed build problems on some platforms
  namely those that have 32bit atomic operations but not 64 bit ones
• bugfix: local hostname was pulled too-early, so that some config
  directives (namely FQDN settings) did not have any effect
• bugfix: imfile did duplicate messages under some circumstances
• added $OMMySQLConfigFile config directive
• added $OMMySQLConfigSection config directive

v6.1.3 [02-02-11]

• experimental support for monogodb added
• added $IMUDPSchedulingPolicy and $IMUDPSchedulingPriority config settings
• added $LocalHostName config directive
• improved tcpsrv performance by enabling multiple-entry epoll
  so far, we always pulled a single event from the epoll interface.
  Now 128, what should result in performance improvement (less API
  calls) on busy systems. Most importantly affects imtcp.
• imptcp now supports non-cancel termination mode, a plus in stability
• imptcp speedup: multiple worker threads can now be used to read data
• new directive $InputIMPTcpHelperThreads added
• bugfix: fixed build problems on some platforms
  namely those that have 32bit atomic operations but not 64 bit ones
• bugfix: local hostname was pulled too-early, so that some config
  directives (namely FQDN settings) did not have any effect
• enhanced tcpflood to support multiple sender threads
  this is required for some high-throughput scenarios (and necessary to
  run some performance tests, because otherwise the sender is too slow).
• added some new custom parsers (snare, aix, some Cisco “specialities”)
  thanks to David Lang Tags: Changelog, devel, rsyslog, v6
  Posted in Changelog | 1 Comment » Changelog for 5.6.3 (v5-stable) Friday, January 28th, 2011 Version 5.6.3  [V5-STABLE] (rgerhards), 2011-01-26
  • bugfix: action processor released memory too early, resulting inpotential issue in retry cases (but very unlikely due to anotherbug, which I also fixed — only after the fix this problem here became actually visible).
  • bugfix: batch processing flagged invalid message as “bad” under somecircumstances
  • bugfix: unitialized variable could cause issues under extreme conditionsplus some minor nits. This was found after a clang static code analyzeranalysis (great tool, and special thanks to Marcin for telling me about it!)
  • bugfix: batches which had actions in error were not properly retried inall cases
  • bugfix: imfile did duplicate messages under some circumstances

v6.1.2 [12-19-10]

• added experimental support for log normalizaton (via liblognorm) support for normalizing log messages has been added in the form of mmnormalize. The core engine (property replacer, filter engine) has been enhanced to support properties from normalized events.

v6.1.1 [12-01-10]

• bugfix(important): problem in TLS handling could cause rsyslog to loop in a tight loop, effectively disabling functionality and bearing the
  risk of unresponsiveness of the whole system.
  Bug tracker: http://bugzilla.adiscon.com/show_bug.cgi?id=194
• support for omhdfs officially added (import from 5.7.1)
• merged imuxsock improvements from 5.7.1 (see there)
• support for systemd officially added (import from 5.7.0)
• bugfix: a couple of problems that imfile had on some platforms, namely Ubuntu (not their fault, but occured there)
• bugfix: imfile utilizes 32 bit to track offset. Most importantly, this problem can not experienced on Fedora 64 bit OS (which has
  64 bit long’s!)
• a number of other bugfixes from older versions imported

v4.7.3 [11-30-10]

• bugfix(important): problem in TLS handling could cause rsyslog to loop

v5.6.1 [11-25-10]

• bugfix(important): problem in TLS handling could cause rsyslog to loop in a tight loop, effectively disabling functionality and bearing the risk of unresponsiveness of the whole system.
  Bug tracker: http://bugzilla.adiscon.com/show_bug.cgi?id=194
• permitted imptcp to work on systems which support epoll(), but not epoll_create().
  Bug: http://bugzilla.adiscon.com/show_bug.cgi?id=204
  Thanks to Nicholas Brink for reporting this problem.
• bugfix: testbench failed if imptcp was not enabled
• bugfix: segfault when an *empty* template was used
• Bug: http://bugzilla.adiscon.com/show_bug.cgi?id=206
  Thanks to David Hill for alerting us.
• bugfix: compile failed with –enable-unlimited-select
  Thanks varmojfekoj for the patch.

v5.6.0 [10-22-10]

• bugfix: a couple of problems that imfile had on some platforms, namely Ubuntu (not their fault, but occured there)
• bugfix: imfile utilizes 32 bit to track offset. Most importantly, this problem can not experienced on Fedora 64 bit OS (which has64 bit long’s!)

v5.7.1 [10-11-10]

• support for Hadoop’s HDFS added (via omhdfs)
• imuxsock now optionally use SCM_CREDENTIALS to pull the pid from the log socket itself (thanks to Lennart Poettering for the suggesting this feature)
• imuxsock now optionally uses per-process input rate limiting, guarding the user against processes spamming the system log (thanks to Lennart Poettering for suggesting this feature)
• added new config statements
  • $InputUnixListenSocketUsePIDFromSystem
  • $SystemLogUsePIDFromSystem
  • $SystemLogRateLimitInterval
  • $SystemLogRateLimitBurst
  • $SystemLogRateLimitSeverity
  • $IMUxSockRateLimitInterval
  • $IMUxSockRateLimitBurst
  • $IMUxSockRateLimitSeverity

v5.7.0 [10-06-10]

• added module impstat to emit periodic statistics on rsyslog counters
• support for systemd officially added
  • acquire /dev/log socket optionally from systemdthanks to Lennart Poettering for this patch
  • sd-systemd API added as part of rsyslog runtime library

v6.1.0 [09-12-10]

• added $Begin, $End and $ScriptScoping config scope statments(at this time for actions only).
• added imptcp, a simplified, Linux-specific and potentielly fastsyslog plain tcp input plugin (NOT supporting TLS!)