<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
<h1 dir="auto">3.38.1</h1>
<h2 dir="auto"><a class="anchor" href="https://github.com/syslog-ng/syslog-ng/blob/master/NEWS.md#highlights"><span class="octicon octicon-link" width="16" height="16"></span></a></h2>
<h2 dir="auto">Highlights</h2>
<h3 dir="auto"><a class="anchor" href="https://github.com/syslog-ng/syslog-ng/blob/master/NEWS.md#sneak-peek-into-syslog-ng-v40"><span class="octicon octicon-link" width="16" height="16"></span></a></h3>
<h3 dir="auto">Sneak peek into syslog-ng v4.0</h3>
<p dir="auto">syslog-ng v4.0 is right around the corner.</p>
<p dir="auto">This release (v3.38.1) contains all major changes, however, they are currently all hidden behind a feature flag. To enable and try those features, you need to specify
<code>@version: 4.0</code> at the top of the configuration file.</p>
<p dir="auto">You can find out more about the 4.0 changes and features <a href="https://github.com/syslog-ng/syslog-ng/blob/master/NEWS-4.0.md">
here</a>.</p>
<p dir="auto">Read our practical introduction to typing at <a href="https://syslog-ng-future.blog/syslog-ng-4-progress-3-38-1-release/" rel="nofollow">
syslog-ng-future.blog</a>.</p>
<h2 dir="auto"><a class="anchor" href="https://github.com/syslog-ng/syslog-ng/blob/master/NEWS.md#features"><span class="octicon octicon-link" width="16" height="16"></span></a></h2>
<h2 dir="auto">Features</h2>
<ul dir="auto">
<li>
<p dir="auto"><code>grouping-by()</code>: added <code>inject-mode(aggregate-only)</code></p>
<p dir="auto">This inject mode will drop individual messages that make up the correlation context (<code>key()</code> groups) and would only yield the aggregate messages (e.g. the results of the correlation). (<a href="https://github.com/syslog-ng/syslog-ng/pull/3998" data-hovercard-type="pull_request" data-hovercard-url="/syslog-ng/syslog-ng/pull/3998/hovercard">#3998</a>)</p>
</li><li>
<p dir="auto"><code>add-contextual-data()</code>: add support for type propagation, e.g. set the type of name-value pairs as they are created/updated to the value returned by the template expression that we use to set the value.</p>
<p dir="auto">The 3rd column in the CSV file (e.g. the template expression) now supports specifying a type-hint, in the format of "type-hint(template-expr)".</p>
<p dir="auto">Example line in the CSV database:</p>
<p dir="auto">selector-value,name-value-pair-to-be-created,list(foo,bar,baz) (<a href="https://github.com/syslog-ng/syslog-ng/pull/4051" data-hovercard-type="pull_request" data-hovercard-url="/syslog-ng/syslog-ng/pull/4051/hovercard">#4051</a>)</p>
</li><li>
<p dir="auto"><code>$(format-json)</code>: add --key-delimiter option to reconstruct JSON objects using an alternative structure separator, that was created using the key-delimiter() option of json-parser(). (<a href="https://github.com/syslog-ng/syslog-ng/pull/4093" data-hovercard-type="pull_request" data-hovercard-url="/syslog-ng/syslog-ng/pull/4093/hovercard">#4093</a>)</p>
</li><li>
<p dir="auto"><code>json-parser()</code>: add key-delimiter() option to extract JSON structure members into name-value pairs, so that the names are flattened using the character specified, instead of dot.</p>
<p dir="auto">Example: Input: {"foo":{"key":"value"}}</p>
<p dir="auto">Using json-parser() without key-delimiter() this is extracted to:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto">
<pre class="notranslate"><code> foo.key="value"
</code></pre>
</div>
<p dir="auto">Using json-parser(key-delimiter("~")) this is extracted to:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto">
<pre class="notranslate"><code> foo~key="value"
</code></pre>
</div>
<p dir="auto">This feature is useful in case the JSON keys contain dots themselves, in those cases the syslog-ng representation is ambigious. (<a href="https://github.com/syslog-ng/syslog-ng/pull/4093" data-hovercard-type="pull_request" data-hovercard-url="/syslog-ng/syslog-ng/pull/4093/hovercard">#4093</a>)</p>
</li></ul>
<h2 dir="auto"><a class="anchor" href="https://github.com/syslog-ng/syslog-ng/blob/master/NEWS.md#bugfixes"><span class="octicon octicon-link" width="16" height="16"></span></a></h2>
<h2 dir="auto">Bugfixes</h2>
<ul dir="auto">
<li>
<p dir="auto">Fixed buffer handling of syslog and timestamp parsers</p>
<p dir="auto">Multiple buffer out-of-bounds issues have been fixed, which could cause hangs, high CPU usage, or other undefined behavior. (<a href="https://github.com/syslog-ng/syslog-ng/pull/4110" data-hovercard-type="pull_request" data-hovercard-url="/syslog-ng/syslog-ng/pull/4110/hovercard">#4110</a>)</p>
</li><li>
<p dir="auto">Fixed building with LibreSSL (<a href="https://github.com/syslog-ng/syslog-ng/pull/4081" data-hovercard-type="pull_request" data-hovercard-url="/syslog-ng/syslog-ng/pull/4081/hovercard">#4081</a>)</p>
</li><li>
<p dir="auto"><code>network()</code>: Fixed a bug, where syslog-ng halted the input instead of skipping a character in case of a character conversion error. (<a href="https://github.com/syslog-ng/syslog-ng/pull/4084" data-hovercard-type="pull_request" data-hovercard-url="/syslog-ng/syslog-ng/pull/4084/hovercard">#4084</a>)</p>
</li><li>
<p dir="auto"><code>redis()</code>: Fixed bug where using redis driver without the
<code>batch-lines</code> option caused program crash. (<a href="https://github.com/syslog-ng/syslog-ng/pull/4114" data-hovercard-type="pull_request" data-hovercard-url="/syslog-ng/syslog-ng/pull/4114/hovercard">#4114</a>)</p>
</li><li>
<p dir="auto"><code>pdbtool</code>: fix a SIGABRT on FreeBSD that was triggered right before pdbtool exits. Apart from being an ugly crash that produces a core file, functionally the tool behaved correctly and this case does not affect syslog-ng itself. (<a href="https://github.com/syslog-ng/syslog-ng/pull/4037" data-hovercard-type="pull_request" data-hovercard-url="/syslog-ng/syslog-ng/pull/4037/hovercard">#4037</a>)</p>
</li><li>
<p dir="auto"><code>regexp-parser()</code>: due to a change introduced in 3.37, named capture groups are stored indirectly in the LogMessage to avoid copying of the value. In this case the name-value pair created with the regexp is only stored as a reference
(name + length of the original value), which improves performance and makes such name-value pairs use less memory. One omission in the original change in 3.37 is that syslog-ng does not allow builtin values to be stored indirectly (e.g. $MESSAGE and a few
of others) and this case causes an assertion to fail and syslog-ng to crash with a SIGABRT. This abort is now fixed. Here's a sample config that reproduces the issue:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto">
<pre class="notranslate"><code>regexp-parser(patterns('(?<MESSAGE>.*)'));
</code></pre>
</div>
<p dir="auto">(<a href="https://github.com/syslog-ng/syslog-ng/pull/4043" data-hovercard-type="pull_request" data-hovercard-url="/syslog-ng/syslog-ng/pull/4043/hovercard">#4043</a>)</p>
</li><li>
<p dir="auto">set-tag: fix cloning issue when string literal were used (see #4062) (<a href="https://github.com/syslog-ng/syslog-ng/pull/4065" data-hovercard-type="pull_request" data-hovercard-url="/syslog-ng/syslog-ng/pull/4065/hovercard">#4065</a>)</p>
</li><li>
<p dir="auto"><code>add-contextual-data()</code>: fix high memory usage when using large CSV files (<a href="https://github.com/syslog-ng/syslog-ng/pull/4067" data-hovercard-type="pull_request" data-hovercard-url="/syslog-ng/syslog-ng/pull/4067/hovercard">#4067</a>)</p>
</li></ul>
<h2 dir="auto"><a class="anchor" href="https://github.com/syslog-ng/syslog-ng/blob/master/NEWS.md#other-changes"><span class="octicon octicon-link" width="16" height="16"></span></a></h2>
<h2 dir="auto">Other changes</h2>
<ul dir="auto">
<li>
<p dir="auto">The <code>json-c</code> library is no longer bundled in the syslog-ng source tarball</p>
<p dir="auto">Since all known OS package managers provide json-c packages nowadays, the json-c submodule has been removed from the source tarball.</p>
<p dir="auto">The <code>--with-jsonc=internal</code> option of the <code>configure</code> script has been removed accordingly, system libraries will be used instead. For special cases, the JSON support can be disabled by specifying
<code>--with-jsonc=no</code>. (<a href="https://github.com/syslog-ng/syslog-ng/pull/4078" data-hovercard-type="pull_request" data-hovercard-url="/syslog-ng/syslog-ng/pull/4078/hovercard">#4078</a>)</p>
</li><li>
<p dir="auto">platforms: Dropped support for ubuntu-impish as it became EOL (<a href="https://github.com/syslog-ng/syslog-ng/pull/4088" data-hovercard-type="pull_request" data-hovercard-url="/syslog-ng/syslog-ng/pull/4088/hovercard">#4088</a>)</p>
</li></ul>
<h2 dir="auto"><a class="anchor" href="https://github.com/syslog-ng/syslog-ng/blob/master/NEWS.md#credits"><span class="octicon octicon-link" width="16" height="16"></span></a></h2>
<h2 dir="auto">Credits</h2>
<p dir="auto">syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng.</p>
<p dir="auto">Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute.</p>
<p dir="auto">We would like to thank the following people for their contribution:</p>
<p dir="auto">Alvin ipraga, Andras Mitzki, Attila Szakacs, Balazs Scheidler, Bálint Horváth, Daniel Klauer, Fabrice Fontaine, Gabor Nagy, HenryTheSir, László Várady, Parrag Szilárd, Peter Kokai, Shikhar Vashistha, Szilárd Parrag, Vivin Peris</p>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);" class="elementToProof">
Installation from binaries: <a href="https://github.com/syslog-ng/syslog-ng#installation-from-binaries<https://github.com/syslog-ng/syslog-ng#installation-from-binaries">
https://github.com/syslog-ng/syslog-ng#installation-from-binaries</a><br>
</div>
</body>
</html>