forked from rsyslog/rsyslog
-
Notifications
You must be signed in to change notification settings - Fork 0
/
ChangeLog
12601 lines (12569 loc) · 702 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
------------------------------------------------------------------------------
Version 8.37.0 [v8-stable] 2018-08-07
- build system: add --enable-default-tests ./configure option
This permits to control the "default tests" in testbench runs. These
are those tests that do not need a special configure option. There are
some situations where we really want to turn them of so that we can
run tests only for a specific component (e.g. ElasticSearch).
This commit also removes the --enable-testbench[12] configure switches,
which were introduced just to work-around travis runtime restrictions.
With the new CI setup and new options we could reduce the Travis runtime
dramatically and so we do not need them any longer.
- overall adaption to gcc 8 which emits new warnings
- fix some build warnings on 32bit systems, namely armhf architecture
- ommail change of behavior: "enable.body" default now "on"
This was always documented to be "on", but actually was "off". Usually, we
fix the doc, but after long discussion the agreement was that in this
specific case it was actually better to change the default.
see also: https://github.com/rsyslog/rsyslog/pull/2791
- core/omfile: race in async writing mode
mutex was not properly locked at all times when the async writing buffer
was flushed
Thanks to Radovan Sroka for the patch.
- core: provide a somewhat better default action name
We now inlcude the module name (e.g. "omelasticsearch" or "builtin:omfile")
as part of the name. This is still not perfect, but hopefully a bit
easier to grasp.
see also https://github.com/rsyslog/rsyslog/issues/342
- new global() parameter "abortOnUncleanConfig"
This provides a new-style alternative to $AbortOnUncleanConfig.
closes https://github.com/rsyslog/rsyslog/issues/2744
- tcpflood no longer links with -lgrcypt
as this is no longer necessary for GnuTLS
Thanks to Michael Biebl for the patch.
- imjournal: add journal-specific impstats counters
these provide some additional insight into journal operations
Thanks to Abdul Waheed for the patch.
- imjournal: fixed startup on missing state file
When starting rsyslog with imjournal for first time it outputs
an error and plugin does not run because no state file exists yet.
Now it skips the loading and creates state file on first persist.
Thanks to Jiri Vymazal for the patch.
- config: enhance backticks "echo" capability
This is now more along the lines of what bash does. We now support
multiple environment variable expansions as well as constant text
between them.
example:
env SOMEPATH is set to "/var/log/custompath"
config is: param=`echo $SOMEPATH/myfile`
param than is expaned to "/var/log/custompath/myfile"
among others, this is also needed inside the testbench to properly
support "make distcheck".
Note: testbench tests follows via separate commit. There will be
no special test, as the testbench itself requires the functionality
at several places, so the coverage will be very good even without
a dedicated test.
- regexp.c: reduce lock contention when using glibc.
When using glibc, we enable per-thread regex to avoid lock contention.
See:
- https://github.com/rsyslog/rsyslog/issues/2759
- https://github.com/rsyslog/rsyslog/pull/2786
- https://sourceware.org/bugzilla/show_bug.cgi?id=11159
This should not affect BSD as they don't seem to take a lock in regexec.
NOTE: it is assumed that we can craft an even better solution than
this patch, but it improves the situation and we do not have time to
craft more. So we decided to merge. For details see
https://github.com/rsyslog/rsyslog/pull/2786
- mmpstrucdata: better error message, support $! in var names
see also https://github.com/rsyslog/rsyslog/issues/1262#issuecomment-404773495
- more explicit error msg with message modification mod on queue
Message modification modules do not work if used with a non-direct queue.
We now make this more explicit in the config parsing error message.
closes https://github.com/rsyslog/rsyslog/issues/1323
- omrabittmq: improve high-load performance
A different pthread mutex is created for each connection (action)
instead of a single one shared by all connections. This will
improve performance when using multiple concurrent connections
to a single (or multiple) RabbitMQ instance(s) (e.g. for load balancing)
Thanks to github user micoq for contributing the patch.
- imudp: replace select() calls by poll()
This improves reliability in extreme cases (more than 1024 fds open when
imudp begins to listen) and potentially improves performance a little.
- ommysql: support mysql unix domain socket:
via action(.. socket="/tmp/mysqld.sock" ..)
Thanks to JoungKyun Kim for contributing this.
- impstats: emit warning if log.syslog="off" and ruleset name given
With this config, "ruleset" is silently ignored, what probably is
not obvious to a user.
closes https://github.com/rsyslog/rsyslog/issues/2821
- build system cleanup: remove no longer needed --enable-memcheck
This was used for a very old testing capability, no longer functional but
causes build to fail if enabled. Replaced by ASAN/valgrind.
Issue detected while testing some other CI settings.
- tools: Updated python based statslog analyzer sample scripts
- developer tools: make devcontainer tool more developer friendly
slight improvement for easy interactive use
- enable better testing via "make distcheck"
Also a couple of changes to testbench worth mentioning:
* use cp -f to ensure files can be overwirtten in VBUILD
* fix issue of missing include test file in EXTRA_DIST
* new supressions
* testbench: try to use local system dependency cache
avoid going to Internet repos if not absolutely necessary. For
development containers, they should be pre-populated with the
important dependencies.
* do not enable libfaketime if ASAN is selected
unfortunately, libfaketime does not work in that case
Note: for modules with non-standard dependencies (e.g. databases),
"make distcheck" only enables what on the original ./configure line
was enabled. This is done in order to ensure that "distcheck" adapts
to what is actually available on the system in question. Rsyslog's
own CI system installs the maximum set of possible dependencies and
so tries the maximum set "make distcheck" can support on a platform.
see also https://github.com/rsyslog/rsyslog/issues/174
- omusrmsg: do not fall back to max username length of 8
This happens if utmp.h and friends are not available and stems back to
the original syslogd. Nowadas, 32 is more appropriate and now being used
in that (now very unlikely) case. The detection logic for UT_NAMESIZE has
also been streamlined.
closes https://github.com/rsyslog/rsyslog/issues/2834
- bugfix config optimizer: error in constant folding
did not work properly if a string and a number were to be folded.
Detected by gcc 8.
- build: fix improper function casts
no real issue, but generated warnings under gcc 8 and thus
broke CI
- bugfix ommysql: unsafe use of strncpy()
also now reports oversize names as user error vs. silent trucation
overly long names only could affect config load phase
- bugfix omhttpfs: fix insecure usage if strncmp()
consequences not evaluated as this is a contributed module.
Detected by gcc 8.
- bugfix mmgrok: cosmetic build issue - compiler warings
caused build under gcc 7 to fail with warning
- bugfix mmkubernetes: potential NULL pointer access
If token file could not be opened, fclose() was passed a NULL pointer.
Thanks to github user jvymazal for finding and Richard Megginson
for fixing the issue.
- bugfix omsnmp: invalid traptype was not detected
this could leave config errors unreported and cause unexpected
behaviour
- bugfix mmkubernetes: default rules use container_name_and_id
also include rulebase files in dist and fix rule so that dot inside
pod name is supported.
Thanks to Richard Megginson for fixing the issue.
- bugfix omelasticsearch: build regression
Commit 6d4635efbb13907bf651b1a6e5a545effe84d9d9 introduced some compile
problems, which were only detected on CentOS6, which unfortunately did
not compile omelasticsearch during CI runs
- bugfix ommongodb: do not force MongoDB to use "PLAIN" auth mechanism
... which also seems not to be handled by current MongoDB.
Remove ?authMechanism=PLAIN URI part to let the mongo library chooses the
default mechanism. One can force a specific authentication mechanism by
adding ?authMechanism=XXX into the uristr argument of the module
Thanks to Jérémie Jourdin for the fix.
closes https://github.com/rsyslog/rsyslog/issues/2753
- build system: do not disable tests via --disable-liblogging-stdlog
This setting controlled both the actual rsyslog functionality as well
as some testbench tests, which use liblogging-stdlog to provide some
specific functionality. This meant those tests were not run since
changing the default. Now untangling the dependency.
- CI:
* most test refactored to use newer testbench plumbing
while no functional change, this permits further enhancements
* ElasticSearch startup timeout in tests increased to care for
slower test systems
* imjournal: fixed tests to actually test plugin functionality
Thanks to Jiri Vymazal for the patch.
* new test for gnutls priority string in librelp
Thanks to github user jvymazal for the patch
* testbench: relax hanging instance detection
This does not work reliably if multiple instances of rsyslog
builds run on a single machine. We need to improve, but this
commit makes conflict less likely and provides some diagnostic
info to help guide us towards a final solution.
* testbench: fix tests that look awfully wrong
These tests indicated they terminate rsyslog forcefully without
drainging the queues, but then checked if they were drained (all
messages processed). That does not make sense, and we cannot
envison why this was written the first place. So we assume some
copy&paste problem was the root of that.
* testbench: refactor tests which used "nettester" tool
Some old tests are carried out via the nettester tool. This was
our initial shot at a testbench a couple of years ago. While it
worked back then, the testbench framework has been much enhanced.
These old tests are nowadays very hard to handle, as they miss
debug support etc. So it is time to refactor them to new style.
As a side-activity, the testbench plumbing has been enhanced to
support some operations commonly needed by these tests. Contrary
to pre-existing plumbing, these new operations are now crafted
using bash functions, which we consider superior to the current
method. So this is also the start of converting the older-style
functionality into bash functions. We just did this now because
it was required and we entangled it into the test refactoring
because it was really needed. Else we had to write old-style
operations and convert them in another commit, which would
have been a waste of time.
Special thanks to Pascal Withopf for the initial step of taking
old tests and putting config as well as test data together into
the refactored tests, on which Rainer Gerhards than could build
to create the new tests and update testbench plumbing.
------------------------------------------------------------------------------
Version 8.36.0 [v8-stable] 2018-06-26
- build system change:
Liblogging-stdlog was introduced to provide a broader ability to send rsyslog
internal logs to different sources. However, most distros did not pick up
that capability and so instead we do a regular syslog() call. We assume that
the actual functionality is never used in practice, so we plan to retire it.
That makes building rsyslog from source easier.
The plan is to disable use of liblogging-stdlog by default during
configure. So users (and distros!) can still opt-in to have it enabled if
they desire.
A couple of releases later, we want to completely remove the functionality,
except if there has desire been shown in the meantime which justifies to keep
liblogging-stdlog.
This version disabled liblogging-stdlog by default. We now also
emit a warning message ("liblogging-stdlog will go away") so that users
know what is going on and my react.
closes https://github.com/rsyslog/rsyslog/issues/2705
see also https://github.com/rsyslog/rsyslog/issues/2706
- add openssl driver alongside GnuTLS one for TLS communication
The openssl driver is curently experimental. It will become the new preferred
driver as it permits us to provide much better end-user error message than
we could provide with GnuTLS. It is also less picky with certificate files
and provides specific error messages if there are certificate problems.
closes: https://github.com/rsyslog/rsyslog/issues/1390
closes: https://github.com/rsyslog/rsyslog/issues/1840
closes: https://github.com/rsyslog/rsyslog/issues/1352
closes: https://github.com/rsyslog/rsyslog/issues/1702
closes: https://github.com/rsyslog/rsyslog/issues/2547
- GnuTLS TLS driver: support intermediate certificates
this is necessary for certificate chains
Thanks to Arne Nordmark for providing the patch.
closes https://github.com/rsyslog/rsyslog/issues/2762
- omelasticsearch: write op types; bulk rejection retries
* Add support for a 'create' write operation type in addition to
the default 'index'. Using create allows specifying a unique id
for each record, and allows duplicate document detection.
* Add support for checking each record returned in a bulk index
request response. Allow specifying a ruleset to send each failed
record to. Add a local variable `omes` which contains the
information in the error response, so that users can control how
to handle responses e.g. retry, or send to an error file.
* Add support for response stats - count successes, duplicates, and
different types of failures.
* Add testing for bulk index rejections.
Thanks to Richard Megginson for the patch.
- lookup tables: reload message now with "info" severity (was "error")
thanks to Adam Chalkley for the patch
- imptcp: add support for regex-based framing
for complex multi-line messages (XML in particular), the multiLine method
does not work well. We now have a capability to specify via a regex when
a frame starts (and the previous thus ends).
adds imptcp input parameter "framing.delimiter.regex"
- imjournal: add statistics counter
following statistics counter are now supported by imjournal
- submitted = total number of messages submitted for processing
closes https://github.com/rsyslog/rsyslog/issues/2549
- config: permit 4-digit file creation modes
permit 4-digit file creation modes (actually 5 with the leading zero) so
that the setgid bit can also be set (and anything else on that position.
closes https://github.com/rsyslog/rsyslog/issues/1092
- ommongodb: add possibility to ignore some insertion error code
new config parameter "allowed_error_codes", which will be ignored if
they happen. For example, 11000 DuplicateKey in case of collection
containing a unique field.
Thanks to Hugo Soszynski for contributing this work
- omprog: simplify 'plugin-with-feedback.py' example
Make the skeleton easier to understand by removing transaction support.
Also, transaction failures did not work as explained in the skeleton,
because of issue #2420. In the future, a 'plugin-with-transactions.py'
example can be added, ideally once the issue is solved.
Thanks to Joan Sala for contributing this.
- core: misadressing when writing disk queue files
when writing disk queue files during shutdown, access to freed
memory can occur under these circumstances:
- action A is processing data, but could not complete it
most importantly, the current in-process batch needs not to
be totally completed. Most probable cause for this scenario
is a suspended action in retry mode.
- action A is called from a ruleset RA which
- does not have a queue assigned
- where RA is called from a ruleset RO which is bound
to the input from which the message originated
- RO must be defined before RA inside the expanded config
- Disk queues (or the disk part of a DA queue) must be utilized by A
When re-injecting the unprocessed messages from A into the disk queue, the
name of ruleset RO is accessed (for persisting to disk). However, RO is
already destructed at this point in time.
The patch changes the shutdown processing of rulesets, so that all
shutdown processing is done before any ruleset data is destructed. This
ensures that all data items which potentially need to be accessed
remain valid as long as some part may potentially try to access them.
This follows a the approach used in
https://github.com/rsyslog/rsyslog/pull/1857
where obviously that part of the problem was not noticed.
see also https://github.com/rsyslog/rsyslog/issues/1122
closes https://github.com/rsyslog/rsyslog/issues/2742
- core: fix message loss on target unavailibility during shutdown
Triggering condition:
- action queue in disk mode (or DA)
- batch is being processed by failed action in retry mode
- rsyslog is shut down without resuming action
In these cases messages may be lost by not properly writing them
back to the disk queue.
closes https://github.com/rsyslog/rsyslog/issues/2760
- imrelp bugfix: error message "librelp too old" is always emitted ...
... even if librelp is current. The codition check was actually missing.
This commit adds it.
closes https://github.com/rsyslog/rsyslog/issues/2712
- imrelp: segfault on startup when cert without priv key is configured
closes https://github.com/rsyslog/rsyslog/issues/2747
- omrelp bugfix: segfault on first message sent when authmode was wrong
A segfault could occur if the authmode was configured to an invalid value.
This is now caught during config processing and an error is reported.
closes https://github.com/rsyslog/rsyslog/issues/2743
- imfile bugfix: double-free on module shutdown
detected by code review, not seen in practice
- imfile/core bugfix: potential misadressing in string copy routine
This can be exposed via imfile, as follows:
- use a regex to process multiline messages
- configure timeouts
- make sure imfile reads a partial message
- wait so that at least one timeout occurs
- add the message termination sequence
This leads to a misadressing, which may have no obvious effects potentially
up to a segfault.
closes https://github.com/rsyslog/rsyslog/issues/2661
- imfile bugfix: if freshStartTail is set some initial file lines missing
When the option is set and a new file is created after rsyslog startup,
freshStartTail is also applied to it. That is data written quickly to it
(before rsyslog can process it) will potentially be discarded. If so,
and how much, depends on the timing between rsyslog and the logging process.
This problem is most likely to be seen in polling mode, where a relatively
long time may be required for rsyslog to find the new file.
This is changed so that now freshStartTail only applies to files that
are already-existing during rsyslog's initial processing of the file
monitors. HOWEVER, depending on the number and location (network?) of
existing files, this initial startup processing may take some time as
well. If another process creates a new file at exactly the time of
startup processing and writes data to it, rsyslog might detect this
file and it's data as prexisting and may skip it. This race is inevitable.
So when freshStartTail is used, some risk of data loss exists. The same
holds true if between the last shutdown of rsyslog and its restart log
file content has been added. This is no rsyslog bug if it occurs.
As such, the rsyslog team advises against activating the freshStartTail
option.
closes https://github.com/rsyslog/rsyslog/issues/2464
- core: fix undefined behaviour (unsigned computation may lead to value < 0)
This was detected by LLVM UBSAN. On some platforms re-setting the rawmsg
inside the message object could lead to invalid computation due to the
fact the the computation was carried out as unsigned and only then
converted to integer.
No known problem in practice.
- CI/QA:
- improved Elasticsearch tests so they can now be run without system-
installed ES service; also enables us to specify specific ES versions
and should now make the tests executable inside a container
------------------------------------------------------------------------------
Version 8.35.0 [v8-stable] 2018-05-15
- imptcp: add ability to configure socket backlog
this can be useful under heavy load.
For a detailled discussion see https://github.com/rsyslog/rsyslog/pull/2561
Thanks to Maxime Graff for implementing this.
- omfile: do not permit filename that only consists of whitespace
- fmhash: new hash function module
implements hash32() and hash64() functions
Thanks to Harshvardhan Shrivastava for implementing these
- some better error messages
- imklog: add ratelimiting capability
On Linux kernel logs are ratelimited only for messages using
printk_ratelimit(). Some logs do not use this facility, so
we ratelimit kernel ourselves.
Thanks to Berend De Schouwer for the patch.
- omkafka: added impstats counters for librdkafka returned statistics
Adds:
* statscallback counters
* librdkafka failure and error counters
* acked message counter
Thanks to Abdul Waheed for implementing this.
- imudp
* use rsyslog message rate-limiter instead of home-grown one
imudp introduced it's own (feature-limited) rate-limiting capability for
message on disallowed senders before we had central rate-limiters
inside rsyslog. Also, that code evolved from running on a single
thread to running on multiple threads, which introduced data races
and so made unreliable.
Now we removed the old rate-limiting capability and depend on the
system rate limiter for internal rsyslog messages.
closes https://github.com/rsyslog/rsyslog/issues/2467
* add stats counter "disallowed"
counts the number of messages discarded due to being received from
disallowed senders
see also https://github.com/rsyslog/rsyslog/issues/2467
- imrelp: add parameter "oversizeMode"
Permits to instruct librelp how to handle oversize messages. The new default
is to truncate messages. Previously, the connection was aborted, what often
lead to stuck messages at the sender side. Now, there are three options passed
down to librelp:
* abort - same behavior as previously, connection is aborted on error
* truncate - do not abort but instead truncate oversize message to
configured max size
* accept - accept all oversize messages (note: this can cause security issues,
see doc for details)
see also https://github.com/rsyslog/rsyslog/pull/1525#issuecomment-384179393
see also https://github.com/rsyslog/rsyslog/issues/2190
closes https://github.com/rsyslog/rsyslog/issues/2633
closes https://github.com/rsyslog/rsyslog/issues/1741
closes https://github.com/rsyslog/rsyslog/issues/1782
closes https://github.com/rsyslog/rsyslog/issues/2496
- core: consistent handling of oversize input messages
In the community we frequently discuss handling of oversize messages.
David Lang rightfully suggested to create a central capability inside
rsyslog core to handle them.
We need to make a distinction between input and output messages. Also,
input messages frequently need to have some size restrictions done at
a lower layer (e.g. protocol layer) for security reasons. Nevertheless,
we should have a central capability
* for cases where it need not be handled at a lower level
* as a safeguard when a module invalidly emits it (imfile is an example,
see https://github.com/rsyslog/rsyslog/pull/2632 for a try to fix it
on the module level - we will replace that with the new capability
described here).
The central capability works on message submission, and so cannot be
circumvented. It has these capabilities:
* overisze message handling modes:
- truncate message
- split message
this is of questionable use, but also often requested. In that mode,
the oversize message content is split into multiple messages. Usually,
this ends up with message segments where all but the first is lost
anyhow as the regular filter rules do not match the other fragments.
As it is requested, we still implemented it.
- accept message as is, even if oversize
This may be required for some cases. Most importantly, it makes
quite some sense when writing messages to file, where oversize
does not matter (accept from a DoS PoV).
* report message to a special "oversize message log file" (not via the
regular engine, as that would obviously cause another oversize message)
This commit, as the title says, handles oversize INPUT messages.
see also https://github.com/rsyslog/rsyslog/issues/2190
closes https://github.com/rsyslog/rsyslog/issues/2681
closes https://github.com/rsyslog/rsyslog/issues/498
Note: this commit adds global parameters:
* "oversizemsg.errorfile",
is used to specify the location of the oversize message log file.
* "oversizemsg.report",
is used to control if an error shall be reported when an oversize
message is seen. The default it "on".
* add global parameter "oversizemsg.input.mode"
is used to specify the mode with which oversized messages will
be handled.
- omfwd: add support for bind-to-address for UDP
To allow the same source address to be used regardless of the egress
interface taken, an option is added for an address to bind the datagram
socket to. Similarly to imudp, it is necessary to add an ipfreebind
option which is set by default, so as to avoid an excess of errors at
startup before the network interface has come up. This enhancement
allows a usecase on networking devices, by which a source interface
that is typically a loopback is specified, on which an address to bind
to is configured. This is so that the same source address is used for
all packets from rsyslog.
Thanks to Mike Manning for the patch.
- template systemd service file proposes higher permitted file handle limit
Especially on busy systems the default are too low. Please keep in mind
that on a very busy system even the now-proposed setting may be too low.
Thanks to github user jvymazal for the patch.
- imuxsock: replace select() call by poll()
While extremely unlikely, imuxsock could abort if a file descriptor
> 1024 was received during the startup phase (never occured in
practice, but theoretically could if imfile monitored a large number
of files and were loaded before imuxsock - and maybe other
strange cases).
see also https://github.com/rsyslog/rsyslog/issues/2615
- nsdsel_ptcp: replace select() by poll()
This removes us of problems with fds > 1024. The performance will
probably also increase in most cases.
Note this is not a replacement for the epoll drivers, but a general
stability improvement when epoll() is not available for some reason.
see also https://github.com/rsyslog/rsyslog/issues/2615
closes https://github.com/rsyslog/rsyslog/issues/1728
closes https://github.com/rsyslog/rsyslog/issues/1459
- omprog: refactor tests, fix child closing issues
Refactor omprog tests. Fix sync issues in these tests by
using the feedback mode (confirmMessages=on) to synchronize
the test with the external program. Closes #2403 (I hope)
Fix omprog not properly closing child process when
signalOnClose=on. Needed for the new tests. Closes #2599
Fix omprog not waiting for the child process to terminate
when signalOnClose=off. Needed for the new tests. Closes #2600
Close all fds before executing the child even when valgrind
is enabled (--enable-valgrind). Needed for the new tests.
Fix memory leak when the xxxTransactionMark parameters were
used.
Thanks to Joan Sala for the patch.
- core: config optimizer did not handle call_indirect
This also caused the emission of an "internal error" error message
closes https://github.com/rsyslog/rsyslog/issues/2665
- debug support: add capability to print testbench-specific timeout reports
done by setting RSYSLOG_DEBUG_TIMEOUTS_TO_STDERR to "on"
this is by default activated inside the testbench
- mmgrok: fix potential segfault
The modules used strtok(), which is not thread-safe. So it will potentially
segfault when multiple instances are spawned (what e.g. happens on busy
systems).
This patch replaces strtok() with its thread-safe counterpart
strtok_r().
see also https://github.com/rsyslog/rsyslog/issues/1359
- imrelp bugfix: maxDataSize could be set lower than maxMessageSize
maxDataSize specifies the length which will still be accepted
It previously could be set to any value, including values lower than the
configured rsyslog max message size, which makes no sense. Now this is
checked an error message is emitted if the size is set too low.
- build system bugfix: build broken if liblogging-stdlog installed in custom path
Thanks to Dirk Hörner for the patch.
- core bugfix: segfault on queue shutdown
if a ruleset queue is in direct mode, a segfault can occur during
rsyslog shutdown. The root cause is that a direct queue does not
have an associated worker thread pool, but the ruleset destructor
does not anticipate that and tries to destruct the worker thread
pool. It needs to do this itself, as otherwise we get a race
between rulesets on shutdown.
This was a regression from
https://github.com/rsyslog/rsyslog/commit/3fbd901b3e6300010
closes https://github.com/rsyslog/rsyslog/issues/2480
- imfile bugfix: statefiles contain invalid JSON
When imfile rewrites state files, it does not truncate previous
content. If the new content is smaller than the existing one, the
existing part will not be overwritten, resulting in invalid json.
That in turn can lead to some other failures.
closes https://github.com/rsyslog/rsyslog/issues/2662
- omfile bugfix: segfault if empty filename was given
closes https://github.com/rsyslog/rsyslog/issues/2417
- fix build issues when atomic operations are not present
for details, see https://github.com/rsyslog/rsyslog/pull/2604
- lmsig_ksils12 bugfix: build and static analyzer issues
The module had a couple of problems building as well as some potential
errors detected by clang static analyzer. These have been fixed.
Thanks to Allan Park for the patch.
closes https://github.com/rsyslog/rsyslog/issues/2517
- impstats bugfix: segfault if bound to non-existing ruleset
segfault happens during shutdown; up until unload of impstats,
rsyslog works correctly, except that no pstats are emitted. This
can be considered to be expected, because the error message
indicates the default ruleset is used instead. This is what
now actually happens.
closes https://github.com/rsyslog/rsyslog/issues/2645
- mmjsonparse bugfix: invalid container name was not detected
in debug builds, this will trigger an assertion. In production
builds, an rsyslog internal error is logged, but rsyslog
continues to run.
closes https://github.com/rsyslog/rsyslog/issues/2584
- mmkubernetes bugfixes: fix lnrules, add defaults, add test
- Fix lnrules for CONTAINER_NAME
- Add pkg check for lognorm >= 2.0.3 so we can set the macro
to enable ln_loadSamplesFromString
- Add some reasonable default values for parameters, such as
kubernetesurl https://kubernetes.default.svc.cluster.local:443
- Clean up sample.conf configuration file
Thanks to Richard Megginson for the patch set.
- build system bugfix: --enable-atomic-operations did not work
closes https://github.com/rsyslog/rsyslog/pull/2604
- bugfix: rsyslog aborts on startup when specific config errors are made
The following errors must be made in rsyslog.conf:
* no action present
* a call statement is used on an undefined ruleset
In this case, rsyslog emits an error message on the missing actions and
then segfaults. Depending on memory layout, it may also continue to run
but do nothing except accepting messages as no action is configured.
This patch make rsyslog properly terminate after the error message. It
is a change in behavior, but there really is no reason why a defunct
instance should be kept running.
closes https://github.com/rsyslog/rsyslog/issues/2399
- build system: remove no longer needed --enable-libcurl configure switch
The --enable-libcurl switch was added to be able to disable libcurl
functionality inside the rsyslog core, see 46f4f43. As libcurl is no
longer used inside the core (due to introducing function modules),
--enable-libcurl needs to be removed.
closes https://github.com/rsyslog/rsyslog/issues/2628
- QA/CI
* fixed races in some tests; root cause was that default enq timeout was too
low - we may also see in the future that other tests also need adjustment
(note that this is not a code problem but rather slow CI environments,
so increasing the timeout to get to a stable test state is the absoulutely
correct thing to do)
* enabled some additional useful compiler warnings
* new test for diskqueue hitting configured disk space limit
* new tests for omfile
* added tests for mmkubernetes
* added tests for some script functions that were missing them
* made far more test compatible with FreeBSD, so that we now have fuller
coverage there
------------------------------------------------------------------------------
Version 8.34.0 [v8-stable] 2018-04-03
- mmkubernetes: new module
Thanks to Richard Megginson and Peter Portante for contributing the module.
- rsyslog script: introduce loadable function modules
rsyslog scripting can now also be extended via loadable modules - they
provides functions (just like loadable input, output, ... modules)
see also http://jan.gerhards.net/2018/03/loadable-rainerscript-functions.html
- imfile: large refactoring of complete module
This commit greatly refactors imfile internal workings. It changes the
handling of inotify, FEN, and polling modes. Mostly unchanged is the
processing of the way a file is read and state files are kept.
This is about a 50% rewrite of the module.
Polling, inotify, and FEN modes now use greatly unified code. Some
differences still exists and may be changed with further commits. The
internal handling of wildcards and file detection has been completely
re-written from scratch. For example, previously when multi-level
wildcards were used these were not reliably detected. The code also
now provides much of the same functionality in all modes, most importantly
wildcards are now also supported in polling mode.
The refactoring sets ground for further enhancements and smaller
refactorings. This commit provides the same feature set that imfile
had previously and all existing CI tests pass, as do some newly
created tests.
Some specific changes:
- bugfix: module parameter "sortfiles" ignored
This parameter only works in Solaris FEN mode, but is otherwise
ignored. Most importantly it is ignored under Linux.
fixes https://github.com/rsyslog/rsyslog/issues/2528
- bugfix: imfile did not pick up all files when not present
at startup
fixes https://github.com/rsyslog/rsyslog/issues/2241
fixes https://github.com/rsyslog/rsyslog/issues/2230
fixes https://github.com/rsyslog/rsyslog/issues/2354
fixes https://github.com/rsyslog/rsyslog/issues/1716
- bugfix: directories only support "*" wildcard, no others
fixes https://github.com/rsyslog/rsyslog/issues/2303
- bugfix: parameter "sortfiles" did only work in FEN mode
fixes https://github.com/rsyslog/rsyslog/issues/2528
- provides the ability to dynamically add and remove files via
multi-level wildcards
see also https://github.com/rsyslog/rsyslog/issues/1280
- the state file name currently has been changed to inode number
This will further be worked on in upcoming PRs
see also https://github.com/rsyslog/rsyslog/issues/2231
- some enhancements were also done to CI tests, most importantly
they were made more compatibile with BSD
Note that most of the mentioned bug fixes cannot be applied to older
versions, as they fix design issues which are solved by the refactoring.
Thus there are not separate commits for them.
There are probably also a number of different issues fixed, which have
not yet been full confirmed. Especially anyone having troubles with imfile
and wildcards will benefit from the refactoring.
closes https://github.com/rsyslog/rsyslog/issues/2359
- omelasticsearch: add support for CA cert, client cert auth
This allows omelasticsearch to perform client cert based authentication
to Elasticsearch.
adds parameters: tls.cacert, tls.mycert, tls.myprivkey
Thanks to Richard Megginson for the patch.
- omfile-hardening: new contributed module for "omfile hardened operations"
This extends omfile with features considered useful for hardening. Comes
at the expense of performance loss and changed semantics.
Thanks to Mikko Kortalainen for contributing this work.
- stream/bugfix: memory leak on stream open if filename as already generated
this can happen if imfile reads a state file. On each open, memory for the
file name can be lost.
We detected this while working on imfile refactoring, so there is no related
bug report. No specific test has been crafted, as the refactored imfile
tests catch it (as soon as they are merged).
- bugfix/omkafka: did not build on platforms without atomic operations
Thanks to github user bruce87en for the patch
- bugfix/core/ratelimiting: SystemLogRateLimitBurst was limited to 65535
rsyslog uses unsigned short for configuration setting SystemLogRateLimitBurst.
Being just 16 bits, unsigned short cannot hold values bigger than 65535. in a
practical setting rsyslog misbehaved with SystemLogRateLimitBurst being bigger
than 65535.
Thanks to github user KaleviKolttonen for the patch.
- bugfix imfile: memory leak in readMode 0
closes https://github.com/rsyslog/rsyslog/issues/2421
- bugfix omfile: some error messages had parameters in wrong order
which made the message look strange, but still readable
Thanks to Hans Rakers for the patch.
- bugfix omprog: file handle leak
There was a fd leak in the feedback feature added in v8.31.0 (github PR #1753).
The leak occurred when omprog was used with the confirmMessages=on setting
and no output setting. One fd was leaked every time the external program was
started.
Thanks to Joan Sala for the patch.
- bugfix imuxsock: data alignment problems
gcc did rightly complain that the cred and ts pointers would cause
alignment problems, so they were converted to structs and the necessary
data was memcpy()'ed to them.
the aux[] buffer was also potentially misaligned, so making a union
out of it and struct cmsghdr insured it was properly aligned.
The problems were especially visible on alpha and ia64 machines.
Thanks to Jason Duerstock for the fix.
- bugfix testbench: some test were accidently not executed
Thanks to Kasumi Hanazuki for the patch.
- bugfix tcp subsystem: keepalive settings mixed up
TCPKeepAliveIntvl and TPCKeepAliveTime were switched. This is now correct and
thus causes a CHANGE OF BeHAVIOR of these settings. We applied this change only
after careful consideration of the effect. The contributor Alexandre Pierret
explained the situation as such:
"From my side, I work with thousands of servers centralizing logs to rsyslog
servers in tcp. All of them are running RHEL 6 and 7. The default rsyslog settings
in RHEL is TCPKeepAlive off. Since there are thousands of connections on the
rsyslog servers, I had to turn the TCPKeepAlive on to setup an agressive policy
regarding ghost connections (following firewall tcp-timeout issue). Basically,
I set up: intvl=10 - probe=5 - time=2 If intvl and time are switched, it won't
break anything. It will just send 5 more empty tcp packets for 10 seconds (5
probe x 2 seconds), which is painless (any professional grade 100€ router can
send more than 1.000.000 PPS). For 3000 servers, it means 3000 pps for 5
seconds (3000 servers x 2 back-and-forth / 2 seconds). Let's take another worst
example: intvl=3600 - probe=5 - time=1. It means one keepalive every hour and
a 5 retry every 1s after a network issue. If the time and intvl values are
switched, it will generate 1 keepalive every seconds, It's a LOT more, but
after 5 probe or packet, it will stop. To summarize, I think it won't
break anything:
* Keepalive is off by default is many linux distribution
* When we enable it, it's to set up an agressive policy. And setting up a
10-5-1, 60-5-2, 2-5-60 or 1-20-1 policy is almost the same.
Bonus: For people setting up their rsyslog from the documentation, it will
now work as expected."
This was convincing, and we actually think that the fast majority of users set
up keepalive based on the doc and did never verify it actually worked as
excpected. So we think that in all those cases, rsyslog will finally work as
intended. So we consider it justified to "change the behavior" here.
full discussion in PR: https://github.com/rsyslog/rsyslog/pull/2367
Thanks to Alexandre Pierret for analyzing the situation and providing the
patch.
- fix some cosmetic issues found by lgtm.com static code analyzer
e.g. header file guard not correctly set - if you really are interested in
details, check git log
- CI
* add build test without atomic operations - now catches missing mutex macros
* add lgtm.com static analyzer (automatically called via GitHub PR)
* improved stability of global-umask.sh test, which unnecessarily used
wildcards for test output file checking.
Thanks to Kasumi Hanazuki for the patch.
* added some test for omprog with transactional interface
Thanks to Joan Sala for the new tests.
* fixed some omjournal tests which did not properly check result
------------------------------------------------------------------------------
Version 8.33.1 [v8-stable] 2018-03-06
- 8.33.0 tarball release was actually pre-8.33.0
... and so did not contain all features. This alone made a re-release
necessary, which is what now happens with 8.33.1.
Note: the git 8.33.0 label was correctly applied, "just" the tarball
was wrong.
- devcontainer: use some more sensible defaults
and add ability to specify generic docker run options
this makes integration into CI (and other scripting) easier
- fix problems with make dist
make dist did not package everything that was needed for CI, thus
resulting in make check failures if build from tarball.
Thanks to Thomas D. (whissi), and Michael Biebl for alerting us on the
problem, providing advise and some of the patches. We also added addt'l
patches ourselves. The problem occured as the CI check for tarball
completeness was more or less disabled a couple of weeks ago, which
unfortunately went unnoticed. We have also applied some more safeguards
to detect such problems in the future.
------------------------------------------------------------------------------
Version 8.33.0 [v8-stable] 2018-02-20
- auto-detect if running inside a container (as pid 1)
adjust defaults in this case to be more container-friendly
- config: add include() script object
This permits to include files (like legacy $IncludeConfig) via a
script object. Needless to say, the script object offers more
features:
- include files can now be
- required, with rsyslog aborting when not present
- required, with rsyslog emitting an error message but otherwise
continuing when not present
- optional, which means non-present include files will be
skipped without notice
This is controlled by the "mode" parameter.
- text can be included form e.g. an environment variable
--> ex: include(text=`echo $ENVVAR`)
This finally really obsoletes $IncludeConfig.
closes https://github.com/rsyslog/rsyslog/issues/2151
- template: add option to generate json "container"
This enables easy JSON generation via template.
This commit also corrects an issue with the constant "jsonf"
format. That was recently added, and the implementation problem
only became visible when used inside a larger json object. No
officially released code is affected, thought - so it rellay
is just a side-note.
closes https://github.com/rsyslog/rsyslog/issues/2347
- core/template: add format jsonf to constant template entries
closes https://github.com/rsyslog/rsyslog/issues/2348
- config: add ability to disable config parameter ("config.enabled")
For auto-generated configs, it is useful to have the ability to disable some
config constructs even though they may be specified inside the config. This
can now be done via the ```config.enabled``` parameter, applicable to all
script objects. If set to ```on``` or not specified, the construct will be
used, if set to any other value, it will be ignored. This can be used
together with the backtick functionality to configure enable and disable
from either a file or environment variable.
closes https://github.com/rsyslog/rsyslog/issues/2431
- script: permit to use environment variables during configuration
new constant string type "backticks", inspired by sh
(sample: `echo $VARNAME`).
- new global config parameter "shutdown.enable.ctlc"
permits to shutdown rsyslog via ctl-c; useful e.g. in containers
- config optimizer: detect totally empty "if" statements and optimize
them out
- template: constant entry can now also be formatted as json field
This enhancements permits to craft clean templates that generate JSON,
e.g. for ElasticSearch consumption (or any other REST API)
- omstdout: support for new-style configuration parameters added
- core: set TZ on startup if not already set
In theory, TZ should be set by the OS. Unfortuantely, this seems
to be not the case any longer on many Linux distros. We now check
it and set it appropriate if not already given.
Thanks to github user JPvRiel for providing an excellent explanation
of the reasoning for this and how to work around it.
closes https://github.com/rsyslog/rsyslog/issues/2054
- imjournal bugfix: file handle leak during journal rotation
Thanks to Peter Portante for the patch
see also: https://github.com/rsyslog/rsyslog/pull/2437
- lmsig_ksils12 bugfix: dirOwner and dirGroup config was not respected
- script bugfix: replace() function worked incorrectly in some cases
If the end of the message was similar to the replacement string, parts
of the string could (not always) be missing.
Thanks to Yaroslav Bo for the patch.
- build system bugfix: --disable-libcurl did not work
Thanks to Dan Molik, Thomas D. (whissi), and Michael Biebl for the patches.
- fixed build issues on Alpine Linux
- core bugfix: misadressing in external command parser
This parser is used whenever a module (e.g. omprog) needs to process
command lines. If command parameters were given, memory misadressing
occured. This could lead to a segfault.
This is a regression in 8.32.0.
closes https://github.com/rsyslog/rsyslog/issues/2408
- core bugfix: small memory leak in external command parser
This parser is used whenever a module (e.g. omprog) needs to process
command lines. On each action definitions for actions that use the
parser a small amount of memory was leakd. It is an uncritical leak
as it only occurs during config parsing. So it leaks a couple of
KiB during startup but does not grow during actual message processing.
This is a regression in 8.32.0.
- core bugfix: string not properly terminated when RFC5424 MSGID is used
This could lead to misadressing when the jsonmesg property was used.
closes https://github.com/rsyslog/rsyslog/issues/2396
- bugfix: strndup() compatibility layer func copies too much
The function did not obey the upper limit, effectively becoming
a strdup(). This was only noticed when the compatibility layer
was required, most importantly on Solaris 10.
- CI system
- we now use well-defined containers for parts of the CI runs
- now also build test under Alpine Linux
- test added for omprog feedback feature
------------------------------------------------------------------------------
Version 8.32.0 [v8-stable] 2018-01-09
- NEW BUILD REQUIREMENTs:
* libfastjson 0.99.8 is now required; older versions lead to bugs in rsyslog
* libczmq >= 3.0.2 is now required for omczmq
This was actually required for quite some while, but not properly checked
during configure run. If the lib was older, build failed. Now configure
detects this and emits the appropiate error message.
* libcurl is now needed for rsyslog core
due to new script function http_request(). This can be turned off by the
new configure option --disable-libcurl. If so, http_request() is not
available.
- rsyslogd: add capability to specify that no pid file shall be written
Command line option -iNONE provides this capability. This utilizes the
pre-existing -i option, but uses the special name "NONE" to turn of the
pid file check feature. Turning off is useful for systems where this no
longer is needed (e.g. systemd based).
closes https://github.com/rsyslog/rsyslog/issues/2143
- ompgsql: considerable enhancements
The PostgreSQL output module was woefully out-of-date the following
list is changes made to update the module to current Rsyslog standards.
* allow for v6 configuration syntax
* configurable ports
* support transactional interface
* push db connection into workers (libpq is threadsafe)
* enable module testing on travis
* ensure configuration syntax backwards compatibility
* formatting around postgres core templating
* use new test conventions
* add new configuration syntax test
* add valgrind tests for new and old syntax
* add threading tests
* add action queue long running tests
* add action queue valgrind test
Thanks to Dan Molik for contributing this great enhancement!
- build system: removed --enable-rtinst configure option
This was a historic debugging option which has been superseeded by
newer tools like valgrind, helgrind, ASAN, TSAN, etc...
- pmrfc3164: support for headerless messages
pmrfc3164 now detects if the first non-SP, non-HT character is either
'{' or '[' and if so assume that no header (TAG, HOSTNAME, DATE) is
given. If so, it uses defaults for these values. The full message is
used as the MSG part in that case. Note that an initial PRI may still
be specified.
This follows the trend to send JSON messages via syslog without any
header. We use default header values in this case.
This right now is a bit experimental; we may roll it back if
problems show up in practice.
closes https://github.com/rsyslog/rsyslog/issues/2030
- omhiredis: add option to use RPUSH instead of LPUSH
see also https://github.com/rsyslog/rsyslog/issues/1625
- mmexternal improvements
* better error reporting if to-be-executed script cannot be executed
* some general cleanup
* better redirection of stdin/out/err for the executed script
* bugfix: argv[0] of the script was missing if command line parameters
were not specified
- omprog: refactored, code shared with mmexternal moved to common object
- logctl tool: refactor to support newer rsyslog standards
* Made the logctl usertool ISO C90 compliant.
* Made the logctl usertool use a homogeneous coding style.
Thanks to Hugo Soszynski for contributing this work (as well as
suggesting some workarounds related to libmongoc/libbson).
- imfile: added support for Solaris File Event notification (FEN)
also improves performance under Solaris, with FEN imfile provides
features equivalent to inotify mode
- core/action: new parameter "action.errorfile"
permits to write failed messages to an "error file" so that they
can be reviewed and potentially be reprocessed
- imfile: added new module parameter "sortFiles"
This permits to process newly created files in sorted order.
- imuxsock: improved status reporting: socket name received from systemd
Providing an indication of what we got from systemd facilitates problem
analysis.
- build system: added new testbench configure switches
now --enable-testbench1 and --enable-testbench2 exists which permit
to enable/disable parts of the testbench. By default, both are on
when --enable-testbench is given. For full testbench coverage, both
options must be given. These options are necessary because under
Travis we hit the max runtime for tests and needed to split tests
over multiple incarnations.
- mmpstrucdata: new parameter "sd_name.lowercase"
to permit preserving case for structured data identifiers
Special thanks to github user alanrobson for the intial commit that
preseves case (on which we based other work).
- omfile: add module-global option "dynafile.donotsuspend"
this permits to enable SUSPENDing dynafile actions. Traditionally,
SUSPEND mode was never entered for dynafiles as it would have blocked
overall processing flow. Default is not to suspend (and thus block).
closes https://github.com/rsyslog/rsyslog/issues/2236
- testbench: add a capability to turn off libfaketime tests via configure
Unfortunately, libfaketime becomes more and more problematic in newer
versions and causes aborts on some platforms. This provides the ability
to turn it off via --disable-libfaketime.
In the longer term, we should consider writing our own replacement.
- testbench: name valgrind tests consistently
all valgrind tests now end in -vg.sh
- RainerScript: add function parse_json()
- RainerScript: add function substring()
- RainerScript: add function http_request()
- RainerScript: add function previous_is_suspended()
This function returns a boolean indicating if the previous action is
suspended (0 - no, 1 - yes). This is useful if arbitrary processing
(other than calling actions) should be made depending on that state.
A prime example for this is probably calling a ruleset.
closes https://github.com/rsyslog/rsyslog/issues/1939
- Patches from BSD projects have been imported
... as far as they still apply. Some patches that patched BSD-specific
code were broadened to be more generic.
- script bugfix: invalid function names were silently ignored
no error message was produced
thanks to Matt Ezell for providing the patch.
- rainerscript: add int2hex() function
- rainerscript: add is_time() function
Thanks to Stephen Workman for implementing this.
- RainerScript: add function script_error() and error-reporting support
This permits script functions that could fail to report errors back, so
that the user can handle them if desired. We use an errno-style of
interface. That means script_error() needs to be called after functions
that supports it. It will return either 0 (all OK) or something else
(an error condition).
The commit also modifies the parse_time() function to use the new
interface. First of all, this is useful for users, and secondly we
needed a capability to craft a testbench test.
closes https://github.com/rsyslog/rsyslog/issues/1978
- testbench: fixed build problem of testbench tools under Alpine Linux
- added --enable-libsystemd configure option to enforce use of libsystemd
so we can fail the build on platforms where this is required
- core/glbl: remove long-unused option $optimizeforuniprocessor
This was still available, but had no effect (for ~10 years or so). The
plumbing is now removed. If someone tries to use the option, an
error message is generated.
closes https://github.com/rsyslog/rsyslog/issues/2280
- core/queue: emit better status messages at rsyslog shutdown
this helps to diagnose issue - unfortunately we need more work to ensure
that the messages always make it to the user. This is a start and
hopefully useful at least for the testbench, possibly more.
- fixed a couple of build issues with gcc-7 (in less frequently used modules)
- fixed a couple of build issues on the arm platform (actually raspbian)
- impstats: fix invalid counter definitions for getrusage() reporting
some of the counters were defined as int (32 bit) vs. intctr_t (64 bit).
On some platforms "long" seems to be 64bit, and getrusage() provides
what we store as int via long. So this caused truncation and/or overflow.
This had undefined effects. Most often, everything worked fine
for values smaller than 2^31 but sometimes we got negative values.
closes https://github.com/rsyslog/rsyslog/issues/1517
- imudp bugfix: potential segfault in ratelimiting
The rate-limiter inside imudp was not set to be thread safe, but was
used across multiple threads. This worked in default configuration,
but failed when RepeatedMsgReduction was set to "on".
Note that it in general is a bug to use a rate-limiter in
non-threadsafe mode across multiple threads. This also causes invalid
rate limiting counts in the default case.
closes https://github.com/rsyslog/rsyslog/issues/441
fixes https://github.com/rsyslog/rsyslog/issues/2132
- imptcp bugfix: access to free'ed memory
When notifyconnectionclose was on, a string buffer was accessed immediately