<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<br>
<div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div>
<h1>3.26.1</h1>
<h2>Highlights</h2>
<ul>
<li>
<p><code>file source</code>: Added a new option to multi-line file sources: <code>
multi-line-timeout()</code><br>
After waiting <code>multi-line-timeout()</code> seconds without reading new data from the file, the last (potentially partial)<br>
message will be flushed and sent through the pipeline as a LogMessage.<br>
Since the multi-line file source detects the end of a message after finding the beginning of the subsequent message<br>
(indented or no-garbage/suffix mode), this option can be used to flush the last multi-line message<br>
in the file after a multi-line-timeout()-second timeout.<br>
There is no default value, i.e. this timeout needs to be explicitly configured.<br>
Example config:</p>
<pre><code>file("/some/folder/events"
multi-line-mode("prefix-garbage")
multi-line-prefix('^EVENT: ')
multi-line-timeout(10)
flags("no-parse")
);
</code></pre>
<p>(<a href="https://github.com/syslog-ng/syslog-ng/pull/2963">#2963</a>)</p>
</li><li>
<p><code>python-http-header</code>: Added this new plugin, which makes it possible for users to implement HTTP header plugins in Python language.<br>
It is built on top of signal-slot mechanism: currently HTTP module defines only one signal, that is
<code>signal_http_header_request</code> and <code>python-http-header</code> plugin implements a python binding for this signal. This means that when the
<code>signal_http_header_request</code> signal is emitted then the connected slot executes the Python code.<br>
The Python interface is:</p>
<pre><code>def get_headers(self, body, headers):
</code></pre>
<p>It should return string List. The headers that will be appended to the request's header.<br>
When the plugin fails, http module won't try to send the http request without the header items by default.<br>
If you want <code>http</code> module to trying to send the request without these headers, just disable
<code>mark-errors-as-critical()</code> function.<br>
Original code was written by Ferenc Sipos.</p>
<details><summary>Example config, click to expand!</summary></details> (<a href="https://github.com/syslog-ng/syslog-ng/pull/3123">#3123</a>)
</li><li>
<p><code>azure-auth-header</code>: Added this new plugin, which generates authorization header for applications connecting to Azure.<br>
It can be used as a building block in higher level SCLs.<br>
Implemented as a <code>signal-slot</code> plugin.</p>
<details><summary>Example config, click to expand!</summary></details> (<a href="https://github.com/syslog-ng/syslog-ng/pull/3078">#3078</a>)
</li><li>
<p><code>python</code>: From now on users can specify a persist name template from python code.</p>
<pre><code>@staticmethod
def generate_persist_name(options):
return options["file_name"]
</code></pre>
<ul>
<li>Usage of this function is necessary, when one <code>python</code> destination is used multiple times in one config.</li><li>Persist name from config takes precedence over <code>generate_persist_name</code>.</li><li>Persist name is exposed through <code>self.persist_name</code>. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3016">#3016</a>)</li></ul>
</li></ul>
<h2>Features</h2>
<ul>
<li><code>set-severity()</code>: Added this new rewrite rule for changing message severity.<br>
It receives a template and sets message severity by evaluating the template.<br>
Numerical and textual severity levels are both supported.<br>
Examples:
<pre><code>rewrite {
set-severity("info");
set-severity("6");
set-severity("${.json.severity}");
};
</code></pre>
(<a href="https://github.com/syslog-ng/syslog-ng/pull/3115">#3115</a>)</li><li><code>$(list-search)</code>: Added a new template function, which returns the first index of a pattern in a list.<br>
Starts the search at <code>start_index</code>. 0 based. If not found, returns empty string.<br>
Usage: <code>$(list-search --mode MODE <pattern> ${list})</code><br>
Where mode can be: <code>literal</code> (default), <code>prefix</code>, <code>substring</code>,
<code>glob</code>, <code>pcre</code>.<br>
Add <code>--start-index <index></code> to change the start index. (<a href="https://github.com/syslog-ng/syslog-ng/pull/2955">#2955</a>)</li><li><code>config version</code>: Made the config version check of the configuration more liberal by accepting version numbers<br>
that had no changes relative to the current version. This means that if you are running 3.26 and the last<br>
semantic change in the configuration was 3.22, then anything between 3.22 and 3.26 (inclusive) is accepted<br>
by <code>syslog-ng</code> without a warning at startup. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3074">#3074</a>)</li><li><code>$SEVERITY instead of $LEVEL</code>: <code>syslog-ng</code> now follows the RFC3164 trend of using
<code>severity</code> instead of <code>level</code><br>
to refer to the severity of the message that is used in the template language (<code>$SEVERITY</code>),<br>
filter expressions (<code>severity()</code>) and so on. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3128">#3128</a>)</li><li><code>http</code>: Added <code>ssl_version("tlsv1_3")</code> and <code>ssl_version("no-tlsv13")</code> options to respectively force and disable TLSv1.3. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3063">#3063</a>)</li><li><code>scl</code>: Improved error message at init, when an <code>scl</code> is missing a dependency. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3015">#3015</a>)</li><li><code>geoip2</code>: Added <code>template()</code> option as an alias for the positional argument string, to match the grammar convention. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3051">#3051</a>)</li><li><code>loggly</code>: Added <code>transport()</code> option, so users can now use it with
<code>tls</code> (or any <code>network()</code> supported transport). (<a href="https://github.com/syslog-ng/syslog-ng/pull/3149">#3149</a>)</li><li><code>config-option-database</code>: Added support for <code>parser</code>, <code>
diskq</code> and <code>hook-commands</code> blocks. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3029">#3029</a>)</li></ul>
<h2>Bugfixes</h2>
<ul>
<li>
<p><code>configure.ac</code>: Fixed <code>gethostbyname()</code> function location detection (<a href="https://github.com/syslog-ng/syslog-ng/pull/3135">#3135</a>)</p>
</li><li>
<p><code>http</code>: Fixed a crash, when <code>workers()</code> was set to 0. We do not allow nonnegative values anymore. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3116">#3116</a>)</p>
</li><li>
<p><code>snmp-dest</code>: <code>engine-id()</code> option now handles 5 to 32 characters, instead of the strict 10 before. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3058">#3058</a>)</p>
</li><li>
<p><code>http</code>: Fixed handling of <code>ssl-version()</code> option, which was ignored before.<br>
Prior this fix, these values of <code>ssl-version</code> in http destination were ignored by syslog-ng:<br>
<code>tlsv1_0</code>, <code>tlsv1_1</code>, <code>tlsv1_2</code>, <code>tlsv1_3</code>. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3083">#3083</a>)</p>
</li><li>
<p><code>network</code> sources: Added workaround for a TLS 1.3 bug to prevent data loss.<br>
Due to a bug in the OpenSSL TLS 1.3 implementation (<a href="https://github.com/openssl/openssl/issues/10880">openssl/openssl#10880</a>),<br>
it is possible to lose messages when one-way communication protocols are used, -<br>
such as the syslog protocol over TLS (<a href="https://tools.ietf.org/html/rfc5425" rel="nofollow">RFC 5425</a>,<br>
<a href="https://tools.ietf.org/html/rfc6587" rel="nofollow">RFC 6587</a>) - and the connection is closed by the client right after sending data.<br>
The bug is in the TLS 1.3 session ticket handling logic of OpenSSL.</p>
<p>To prevent such data loss, we've disabled TLS 1.3 session tickets in all syslog-ng network sources.<br>
Tickets are used for session resumption, which is currently not supported by syslog-ng.</p>
<p>The <code>loggen</code> testing tool also received some bugfixes (<a href="https://github.com/syslog-ng/syslog-ng/pull/3064">#3064</a>), which reduce the<br>
likelihood of data loss if the target of loggen has not turned off session tickets.</p>
<p>If you're sending logs to third-party OpenSSL-based TLS 1.3 collectors, we recommend turning session<br>
tickets off in those applications as well until the OpenSSL bug is fixed. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3082">#3082</a>)</p>
</li><li>
<p><code>cmake</code>: Now we install <code>loggen</code> headers, as we do with <code>
autotools</code>. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3067">#3067</a>)</p>
</li><li>
<p><code>graylog2</code>, <code>format-gelf</code>: Fixed sending empty message, when
<code>${PID}</code> is not set.<br>
Also added a default value "-" to empty <code>short_message</code> and <code>host</code> as they are mandatory fields. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3112">#3112</a>)</p>
</li><li>
<p><code>loggen</code>: fix dependency error with cmake + openssl from nonstandard location (<a href="https://github.com/syslog-ng/syslog-ng/pull/3062">#3062</a>)</p>
</li><li>
<p><code>config-option-database</code>: Fixed reading 'grammar' and 'parser' files on 'POSIX' environment (<a href="https://github.com/syslog-ng/syslog-ng/pull/3125">#3125</a>)</p>
</li><li>
<p><code>file source</code>: Fixed <code>file</code> source not able to process new message after
<code>log-msg-size()</code> increase. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3075">#3075</a>)</p>
</li><li>
<p><code>checkpoint parser</code>: Fixed parsing ISO timestamp. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3056">#3056</a>)</p>
</li><li>
<p><code>secret-storage</code>: Fixed some cases, where diagnostical logs were truncated. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3141">#3141</a>)</p>
</li><li>
<p><code>loggen, dqtool</code>: Fixed a crash, when writing error/debug message or relocating qfile. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3069">#3069</a>)</p>
</li><li>
<p>build: Fixed a compatibility related build error on Solaris 11. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3070">#3070</a>)</p>
</li><li>
<p><code>loggen</code>: Fixed address resolution when only loopback interface was configured. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3048">#3048</a>)</p>
</li></ul>
<h2>Packaging</h2>
<ul>
<li><code>scl</code>: Moved <code>scl</code> files to the core package. (<a href="https://github.com/syslog-ng/syslog-ng/pull/2979">#2979</a>)</li><li><code>RHEL</code>: Now we include the <code>packaging/rhel/</code> folder in our release tarball. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3071">#3071</a>)</li><li><code>RHEL 8 / CentOS 8</code>: Added RHEL 8 / CentOS 8 support to <code>syslog-ng.spec</code> (<a href="https://github.com/syslog-ng/syslog-ng/pull/3034">#3034</a>)</li></ul>
<h2>Notes to developers</h2>
<ul>
<li>
<p><code>signal-slot-connector</code>: Introduced a generic event handler interface for
<code>syslog-ng</code> modules.</p>
<ul>
<li>The concept is simple:
<ul>
<li>There is a SignalSlotConnector which stores Signal - Slot connections</li><li>Signal : Slot = 1 : N, so multiple slots can be assigned to the same Signal.</li><li>When a Signal is emitted, the connected Slots are executed.</li><li>Signals are string literals and each module can define its own signals.</li></ul>
</li><li>Interface/protocol between signals and slots:
<ul>
<li>A macro (SIGNAL) can be used for defining signals as string literals:</li></ul>
</li></ul>
<pre><code>SIGNAL(module_name, signal, signal_parameter_type)
</code></pre>
<p>The parameter type is for expressing a kind of contract between signals and slots.</p>
<ul>
<li>Usage:</li></ul>
<pre><code> #define signal_cfg_reloaded SIGNAL(config, reloaded, GlobalConfig)
the generated literal:
"config::signal_reloaded(GlobalConfig *)"
</code></pre>
<ul>
<li><code>emit</code> passes the argument to the slots connected to the emitted signal. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3043">#3043</a>)</li></ul>
</li><li>
<p><code>http</code>: Defined the Signal interface for HTTP - with one signal at this time.<br>
What's in the changeset?</p>
<ul>
<li>List ADT (abstract data type for list implementations) added to lib.
<ul>
<li>Interface:
<ul>
<li>append</li><li>foreach</li><li>is_empty</li><li>remove_all</li></ul>
</li></ul>
</li><li>Implemented the List ADT in http module with <code>struct curl_slist</code> for storing the headers.</li><li>HTTP signal(s):
<ul>
<li>Currently only one signal is added, <code>header_request</code>.<br>
Note, that the license for <code>http-signals.h</code> is <em>LGPL</em> . (<a href="https://github.com/syslog-ng/syslog-ng/pull/3044">#3044</a>)</li></ul>
</li></ul>
</li><li>
<p><code>example-modules</code>: Added example http slot plugin.<br>
This plugin is an example plugin that implements a slot for a HTTP signal (<code>signal_http_header_request</code>).<br>
When the plugin is <code>attached</code>, it <code>CONNECT</code> itself to the signal.<br>
When the signal is emitted by the http module, the slot is executed and append the
<code>header</code> to the http headers.<br>
<code>header</code> is set in the config file.</p>
<details><summary>Example config, click to expand!</summary></details> (<a href="https://github.com/syslog-ng/syslog-ng/pull/3093">#3093</a>)
</li><li>
<p><code>NEWS.md</code>: From now on, for every PR that we want to include in the newsfile,<br>
we must create the news entry with the PR itself. See <code>news/README.md</code>. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3066">#3066</a>)</p>
</li><li>
<p><code>snmp test in Light</code>: Added <code>snmp</code> destination tests in the Light test framework.<br>
These tests requires <code>snmptrapd</code> as an external dependency. If you don't want to run this test,<br>
you can use the pytest's marker discovery feature: <code>python -m pytest ... -m 'not snmp'</code><br>
The tests are run by syslog-ng's Travis workflow. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3126">#3126</a>)</p>
</li><li>
<p><code>cmake</code>: Added <code>add_module</code> function to <code>cmake</code> to normalize
<code>CMakeLists.txt</code> files for modules. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3106">#3106</a>)</p>
</li><li>
<p><code>dbld</code>: Introduced syslog-ng-kira as a new CI image (<a href="https://github.com/syslog-ng/syslog-ng/pull/3125">#3125</a>)</p>
</li><li>
<p>FunctionalTests: Functional tests are now Python3 compatible (<a href="https://github.com/syslog-ng/syslog-ng/pull/3144">#3144</a>)</p>
</li><li>
<p><code>dbld</code>: Added Ubuntu 19.10 and 20.04 (<a href="https://github.com/syslog-ng/syslog-ng/pull/3091">#3091</a>)</p>
</li><li>
<p><code>dbld</code>: Added option to customize <code>shell</code> command.<br>
With this change, it is possible to override the option with <code>rules.conf</code>, while keeping the default behaviour.<br>
The simplest example: use existing images, start a new one if there is none. (use docker rm manually if you want to update)</p>
<pre><code>DOCKER_SHELL=$(DOCKER) inspect $* > /dev/null 2>&1; \
if [ $$? -eq 0 ]; then \
$(DOCKER) start -ia $*; \
else \
$(DOCKER) run $(DOCKER_RUN_ARGS) -ti --name $* balabit/syslog-ng-$* /source/dbld/shell; \
fi
</code></pre>
<p>(<a href="https://github.com/syslog-ng/syslog-ng/pull/3038">#3038</a>)</p>
</li></ul>
<h2>Other changes</h2>
<ul>
<li><code>python</code>: Added <code>--with-python3-home</code> configure option to use a hard-coded
<code>PYTHONHOME</code> for Python-based plugins.<br>
This can be useful when a Python interpreter is bundled with syslog-ng.<br>
Relocation is supported, for example: <code>--with-python3-home='${exec_prefix}'</code> (<a href="https://github.com/syslog-ng/syslog-ng/pull/3134">#3134</a>)</li><li><code>afmongodb</code>: Removed the support of deprecated legacy configurations (<a href="https://github.com/syslog-ng/syslog-ng/pull/3092">#3092</a>)</li><li><code>http</code>: <code>use-system-cert-store()</code> now autodetects the system provided cert-store (<a href="https://github.com/syslog-ng/syslog-ng/pull/3086">#3086</a>)</li><li>doc: Added manual page for <code>persist-tool</code>. (<a href="https://github.com/syslog-ng/syslog-ng/pull/3072">#3072</a>)</li></ul>
<h2>Credits</h2>
<p>syslog-ng is developed as a community project, and as such it relies<br>
on volunteers, to do the work necessarily to produce syslog-ng.</p>
<p>Reporting bugs, testing changes, writing code or simply providing<br>
feedback are all important contributions, so please if you are a user<br>
of syslog-ng, contribute.</p>
<p>We would like to thank the following people for their contribution:</p>
<p>Andras Mitzki, Antal Nemes, Attila Szakacs, Balazs Scheidler, Dylan Perry, Gabor Nagy, Laszlo Budai,<br>
Laszlo Szemere, László Várady, Norbert Takacs, Peter Czanik, Péter Kókai, Romain Tartičre, Tomá Mózes.</p>
<p><br>
</p>
</div>
</div>
</div>
</body>
</html>