June 2022 - syslog-ng - lists.balabit.hu

Re: [syslog-ng] Local sources seem not to be working
by Szilard Parrag (sparrag) 11 Jan '23

11 Jan '23

Hi Alex, We've checked it too and syslog-ng does not release the file descriptor of journald even with flow-control enabled. Also, your internal logs seem rather terse, maybe there is a filter which filters out the important parts. Could you please check it? Szilard

4 12

UDP drops with syslog-ng 3.24.1-1
by brian hoffman 05 Oct '22

05 Oct '22

We've been centrally logging with syslog-ng for about 5 years now. Over that time, the number of sources has grown significantly, and at some point we crossed a line where drops were happening (a quick survey of 3 million syslog packets yielded 420 unique currently sending hosts). After much research and experimentation, we've been able to get to the point where throughout the day there are 0 drops for the most part. This was achieved by installing the latest syslog-ng (not the RedHat packaged one) and creating a source for each CPU. Occasionally, though, we still have periods of drops so I'm trying to eliminate these last few. Here are some relevant configuration items:2 RedHat 7.8 VMs (load balanced via an F5) with 16GB memory and 4 CPUs each running syslog-ng-3.24.1-1.el7.x86_64.net.core.rmem_default = 212992net.core.rmem_max = 268435456 log_fifo_size(268435456); source s_network {network(ip("0.0.0.0") port(514) transport("udp") so_rcvbuf(441326592) so-reuseport(1) persist-name("udp1"));network(ip("0.0.0.0") port(514) transport("udp") so_rcvbuf(441326592) so-reuseport(1) persist-name("udp2"));network(ip("0.0.0.0") port(514) transport("udp") so_rcvbuf(441326592) so-reuseport(1) persist-name("udp3"));network(ip("0.0.0.0") port(514) transport("udp") so_rcvbuf(441326592) so-reuseport(1) persist-name("udp4"));network(ip("0.0.0.0") port(514) transport("tcp") max_connections(200) keep_alive(yes) so_rcvbuf(67108864));}; We are limited to UDP, unfortunately, because we do not have control over the devices/networks/etc. that are sending to us, but we have changed as many of the internal senders and destinations to TCP as we can. With a script I created to view the packets, including drops, as well as the individual RECVQs, the issue can be illustrated. Here's what things look like normally:Thu May 7 10:48:15 EDT 2020, 27003 IP pkts rcvd,26980 IP pkts sent,24951 UDP pkts rcvd, 28075 UDP pkts sent,0 UDP pkt rcv err RECVQ-1=2176RECVQ-2=0RECVQ-3=0RECVQ-4=0Thu May 7 10:48:16 EDT 2020, 28453 IP pkts rcvd,28426 IP pkts sent,26185 UDP pkts rcvd, 29180 UDP pkts sent,0 UDP pkt rcv errRECVQ-1=0RECVQ-2=0RECVQ-3=4352RECVQ-4=0Thu May 7 10:48:17 EDT 2020, 28294 IP pkts rcvd,28276 IP pkts sent,26277 UDP pkts rcvd, 28709 UDP pkts sent,0 UDP pkt rcv errRECVQ-1=2176RECVQ-2=0RECVQ-3=0RECVQ-4=0 The RECVQs are sparsely used, and there are no errors. Around 9pm every night, the packet counts go up significantly (probably due to backup related logs):Wed May 6 21:00:08 EDT 2020, 66382 IP pkts rcvd,66366 IP pkts sent,39405 UDP pkts rcvd, 67592 UDP pkts sent,0 UDP pkt rcv errRECVQ-1=1595008RECVQ-2=106217088RECVQ-3=53694976RECVQ-4=31858816Wed May 6 21:00:09 EDT 2020, 69317 IP pkts rcvd,69338 IP pkts sent,44446 UDP pkts rcvd, 75958 UDP pkts sent,0 UDP pkt rcv errRECVQ-1=13056RECVQ-2=126397312RECVQ-3=75568128RECVQ-4=41626880Wed May 6 21:00:10 EDT 2020, 71205 IP pkts rcvd,71227 IP pkts sent,43657 UDP pkts rcvd, 74603 UDP pkts sent,0 UDP pkt rcv errRECVQ-1=920448RECVQ-2=146122752RECVQ-3=100951168RECVQ-4=52622208Wed May 6 21:00:12 EDT 2020, 69578 IP pkts rcvd,69454 IP pkts sent,124465 UDP pkts rcvd, 163367 UDP pkts sent,0 UDP pkt rcv errRECVQ-1=13140864RECVQ-2=44494848RECVQ-3=125579136RECVQ-4=0 Still, though, it's handling it with no errors. But then at some point a threshold is reached and errors start piling up:Wed May 6 21:00:20 EDT 2020, 63177 IP pkts rcvd,63291 IP pkts sent,0 UDP pkts rcvd, 0 UDP pkts sent,38011 UDP pkt rcv errRECVQ-1=536871424RECVQ-2=200357376RECVQ-3=292948352RECVQ-4=28890752Wed May 6 21:00:21 EDT 2020, 69501 IP pkts rcvd,69464 IP pkts sent,0 UDP pkts rcvd, 1 UDP pkts sent,42158 UDP pkt rcv errRECVQ-1=536871424RECVQ-2=223551360RECVQ-3=314995584RECVQ-4=41735680Wed May 6 21:00:23 EDT 2020, 69962 IP pkts rcvd,69978 IP pkts sent,0 UDP pkts rcvd, 2 UDP pkts sent,43775 UDP pkt rcv errRECVQ-1=536871424RECVQ-2=244732544RECVQ-3=338239616RECVQ-4=53858176Wed May 6 21:00:24 EDT 2020, 68266 IP pkts rcvd,68216 IP pkts sent,0 UDP pkts rcvd, 0 UDP pkts sent,43118 UDP pkt rcv errRECVQ-1=536871424RECVQ-2=265258752RECVQ-3=360643712RECVQ-4=65362688 The common denominator I've found is that one of the RECVQs hits 536,871,424. This number seems to be almost exactly double (512 difference) the rmem.max/log_fifo_size (268,435,456). Even though there seems to be capacity in the other RECVQs, just one of those hitting that magic number seems to be enough to throw things out of whack. During this time, the CPU usage for syslog-ng also drops: top - 21:00:11 up 2 days, 8:40, 2 users, load average: 1.09, 1.41, 1.32 PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 7214 root 20 0 2111388 1.7g 5392 S 123.6 10.9 3080:46 syslog-ng top - 21:00:14 up 2 days, 8:40, 2 users, load average: 1.00, 1.39, 1.31 PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 7214 root 20 0 2111388 1.7g 5392 S 24.6 10.9 3080:46 syslog-ng top - 21:00:17 up 2 days, 8:40, 2 users, load average: 1.00, 1.39, 1.31 PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 7214 root 20 0 2111388 1.7g 5392 S 7.6 10.9 3080:47 syslog-ng As best I can tell, based on the reading I've done, the message counts we're getting should be doable, but it's still not clear exactly how to size some of these options as they relate to UDP (like log_fetch_limit, which we do not have set). Anything else I should try?

2 4

Environment variables in syslog
by Faisal Chishti 28 Jun '22

28 Jun '22

Hellow, Please see below the snippet from my syslog-ng.conf file. ABC_LOG_PATH is the environment variable on the host that contains the path. I am trying to access the env variable within the config. It does not throw any error and the configuration is valid but it does not work properly. I don't see the file agent.log being used at all. source s_agent { file("`ABC_LOG_PATH`/agent.log" follow-freq(1) flags(no-parse)); }; root@syslog-ng-784fdc497-pgdzr:/# syslog-ng --version syslog-ng 3 (3.30.1) Config version: 3.29 Installer-Version: 3.30.1 Revision: Compile-Date: Apr 12 2022 20:15:37 Module-Directory: /usr/lib/syslog-ng Module-Path: /usr/lib/syslog-ng Include-Path: /usr/share/syslog-ng/include Available-Modules: add-contextual-data,afamqp,affile,afprog,afsocket,afsql,afstomp,afuser,appmodel,azure-auth-header,basicfuncs,cef,confgen,cryptofuncs,csvparser,dbparser,disk-buffer,graphite,hook-commands,http,json-plugin,kvformat,linux-kmsg-format,map-value-pairs,mod-python,pseudofile,redis,secure-logging,stardate,syslogformat,system-source,tags-parser,timestamp,xml Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: off Enable-TCP-Wrapper: off Enable-Linux-Caps: off Enable-Systemd: off root@syslog-ng-784fdc497-pgdzr:/# uname -a Linux syslog-ng-784fdc497-pgdzr 4.18.0-147.3.1.el8_1.x86_64 #1 SMP Fri Jan 3 23:55:26 UTC 2020 x86_64 GNU/Linux root@syslog-ng-784fdc497-pgdzr:/# -- Regards, Faisal

2 1

I am a novice on syslog-ng needs help.
by Alexandre Adao 20 Jun '22

20 Jun '22

Hello, I am a novice on syslog-ng. I need some assistance on installing syslog-ng and looking for a good recommendation on step-by-step instructions for Ubuntu (prefered OS) or Windows environment. I googled it but I My goal is to send the logs to splunk. Any help would be appreciated. Thanks, --Alex

3 3

Insider 2022-06: 3.37; hardware; Apache; disk-buffer;
by Peter Czanik (pczanik) 16 Jun '22

16 Jun '22

Dear syslog-ng users, This is the 102nd issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news. NEWS syslog-ng 3.37 released ----------------------- Balázs Scheidler, founder of the syslog-ng project, describes the latest syslog-ng release: “syslog-ng 3.37 has just been released, packages available in various platforms this week. You can get the detailed release notes on the github releases page, however I felt this would be a good opportunity to revisit my draft on the syslog-ng long term objectives and how this release builds in that direction.” Read the rest of the blog at https://syslog-ng-future.blog/syslog-ng-3-37-released/ When (not) to use the syslog-ng disk-buffer ------------------------------------------- The syslog-ng disk buffer is one of the most often used syslog-ng options to ensure message delivery. However, it is not always necessary and using the safest variant has serious performance impacts. If you utilize disk-buffer in your syslog-ng configuration, it is worth to make sure that you use a recent syslog-ng version. >From this blog, you can learn when to use the disk-buffer option, the main differences between reliable and non-reliable disk-buffer, and why is it worth to use the latest syslog-ng version. https://www.syslog-ng.com/community/b/blog/posts/when-not-to-use-the-syslog… Hardware for a syslog-ng server ------------------------------- What hardware to use for a syslog-ng server? It is a frequent question with no definite answer. It depends on many factors: the number and type of sources, the number of logs, the way logs are processed, and so on. My experience is that for the majority users even a Raspberry Pi would be enough. But of course, not for everyone. https://www.syslog-ng.com/community/b/blog/posts/hardware-for-a-syslog-ng-s… Analyzing Apache HTTPD logs in syslog-ng ---------------------------------------- Recently, I started my own blog, and as Google Analytics seems to miss a good part of visitors, I wanted to analyze my web server logs myself. I use syslog-ng to read Apache logs, process them, and store them to Elasticsearch. Along the way, I resolve the IP address using a Python parser, analyze the Agent field of the logs, and also use GeoIP to locate the user on the map. >From this blog, you can learn how I built my configuration. Note that once I was ready, I realized that my configuration is not GDPR compliant, so I also show you which parts to remove from the final configuration :-). https://www.syslog-ng.com/community/b/blog/posts/analyzing-apache-httpd-log… WEBINARS * Register for our latest webinars at https://www.syslog-ng.com/event/syslogng-webcast-series-2022/ * You can browse recordings of past webinars at https://www.syslog-ng.com/events/ Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://syslog-ng.com/blog/ Peter Czanik (CzP) <peter.czanik(a)oneidentity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik

1 0

Test email.
by Tamás Pál 12 Jun '22

12 Jun '22

Please ignore this email.

1 0

Re: [syslog-ng] syslog-ng Digest, Vol 206, Issue 2
by Александр Масленников 10 Jun '22

10 Jun '22

i'm not sure that *format-flat-json* works with lists same as with nested dicts. My example uses format-flat-json, but without an additional filter on pothon, I was unable to flatten it There is original message { "operation": "CLIENT_RESPONSE", "identity": "ns-server.example.com", "family": "INET", "protocol": "TCP", "query-ip": "192.168.xx.zz", "query-port": "51000", "response-ip": "192.168.yy.zz", "response-port": "53", "length": 691, "rcode": "NOERROR", "qname": "_dnsaddr.bootstrap.libp2p.io", "qtype": "TXT", "latency": "0.000000", "timestamp-rfc3339": "2022-06-06T08:47:58.797332215Z", "answers": [{ "name": "_dnsaddr.bootstrap.libp2p.io", "rdatatype": "TXT", "ttl": 600, "rdata": "dnsaddr=/dnsaddr/ams-2.bootstrap.libp2p.io/p2p/QmbLHAnMoJPWSCR5Zhtx6BHJX9KiKNN6tpvbUcqanj75Nb" }, { "name": "_dnsaddr.bootstrap.libp2p.io", "rdatatype": "TXT", "ttl": 600, "rdata": "dnsaddr=/dnsaddr/sjc-1.bootstrap.libp2p.io/p2p/QmNnooDu7bfjPFoTZYxMNLWUQJyrVwtbZg5gBMjTezGAJN" }, { "name": "_dnsaddr.bootstrap.libp2p.io", "rdatatype": "TXT", "ttl": 600, "rdata": "dnsaddr=/dnsaddr/ewr-1.bootstrap.libp2p.io/p2p/QmQCU2EcMqAqQPR2i9bChDtGNJchTbq5TbXJJ16u19uLTa" }, { "name": "_dnsaddr.bootstrap.libp2p.io", "rdatatype": "TXT", "ttl": 600, "rdata": "dnsaddr=/dnsaddr/ams-rust.bootstrap.libp2p.io/p2p/12D3KooWEZXjE41uU4EL2gpkAQeDXYok6wghN7wwNVPF5bwkaNfS" }, { "name": "_dnsaddr.bootstrap.libp2p.io", "rdatatype": "TXT", "ttl": 600, "rdata": "dnsaddr=/dnsaddr/sjc-2.bootstrap.libp2p.io/p2p/QmZa1sAxajnQjVM8WjWXoMbmPd7NsWhfKsPkErzpm9wGkp" }, { "name": "_dnsaddr.bootstrap.libp2p.io", "rdatatype": "TXT", "ttl": 600, "rdata": "dnsaddr=/dnsaddr/nrt-1.bootstrap.libp2p.io/p2p/QmcZf59bWwK5XFi76CZX8cbJ4BhTzzA3gU1ZjYZcYW3dwt" }], "country-isocode": "-" } I would be very grateful to you if you have a solution using the built-in functions of syslog-ng. пт, 10 июн. 2022 г. в 15:00, <syslog-ng-request(a)lists.balabit.hu>: > Send syslog-ng mailing list submissions to > syslog-ng(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/syslog-ng > or, via email, send a message with subject or body 'help' to > syslog-ng-request(a)lists.balabit.hu > > You can reach the person managing the list at > syslog-ng-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of syslog-ng digest..." > > > Today's Topics: > > 1. need help with parser to make flat nested json list of > dictionaries (????????? ???????????) > 2. Re: need help with parser to make flat nested json list of > dictionaries (Peter Kokai (pkokai)) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 10 Jun 2022 11:02:55 +0300 > From: ????????? ??????????? <alexander.a.maslennikov(a)gmail.com> > To: syslog-ng(a)lists.balabit.hu > Subject: [syslog-ng] need help with parser to make flat nested json > list of dictionaries > Message-ID: > <CA+G0nAjp1b6_50LbCROVPje1_B4R_AzNYiZ-_dT0m= > fXcqwmHA(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > hi all > i have a json message that contains a nested json list of dicts > > {"a":1,"b":[{"c":1},{"c":2},{"c":3}]} > > i want to flat that message, so expected result looks like { > "a": 1, > "b_0_c": 1, > "b_1_c": 2, > "b_2_c": 3 > } > > My approach is a python implemented parser. > Is it possible to achieve the same result using the built-in syslog-ng > tools? > My solution below > > @define kafka-implementation kafka-c > > python { > > import collections > import json > > class FlattenedJson(object): > > def parse(self, log_message, flat_message=None): > def flatten(d, parent_key='', sep='_'): > items = [] > for k, v in d.items(): > new_key = parent_key + sep + k if parent_key else k > if isinstance(v, collections.MutableMapping): > items.extend(flatten(v, new_key, sep=sep).items()) > elif isinstance(v, list): > for idx, value in enumerate(v): > items.extend(flatten(value, new_key + sep + > str(idx), sep).items()) > else: > items.append((new_key, v)) > return dict(items) > try: > decoded_msg = > json.loads(log_message['MESSAGE'].decode('utf-8')) > flat_message = flatten(decoded_msg) > final_message = > str(json.dumps(flat_message)).encode(encoding='utf-8') > log_message['MESSAGE'] = final_message > except Exception as error: > log_message['python_error'] = 'An exception occurred: > {}'.format(error) > return True > }; > > destination d_kafka_dnstap { > kafka( > topic("mytopic") > bootstrap-servers("localhost:9092") > message("$(format-flat-json --scope all-nv-pairs > application_name=myapp @timestamp=${ISODATE} )") > ); > }; > > source s_net_dnstap { network( transport(udp) port(514) flags(no-parse) ); > }; > > parser p_dnstap { channel { > parser { python(class("FlattenedJson")); }; > parser { json-parser(prefix("dnstap.")); }; > }; > }; > > log { source(s_net_dnstap); parser(p_dnstap); destination(d_kafka_dnstap); > }; >

2 1

need help with parser to make flat nested json list of dictionaries
by Александр Масленников 10 Jun '22

10 Jun '22

hi all i have a json message that contains a nested json list of dicts {"a":1,"b":[{"c":1},{"c":2},{"c":3}]} i want to flat that message, so expected result looks like { "a": 1, "b_0_c": 1, "b_1_c": 2, "b_2_c": 3 } My approach is a python implemented parser. Is it possible to achieve the same result using the built-in syslog-ng tools? My solution below @define kafka-implementation kafka-c python { import collections import json class FlattenedJson(object): def parse(self, log_message, flat_message=None): def flatten(d, parent_key='', sep='_'): items = [] for k, v in d.items(): new_key = parent_key + sep + k if parent_key else k if isinstance(v, collections.MutableMapping): items.extend(flatten(v, new_key, sep=sep).items()) elif isinstance(v, list): for idx, value in enumerate(v): items.extend(flatten(value, new_key + sep + str(idx), sep).items()) else: items.append((new_key, v)) return dict(items) try: decoded_msg = json.loads(log_message['MESSAGE'].decode('utf-8')) flat_message = flatten(decoded_msg) final_message = str(json.dumps(flat_message)).encode(encoding='utf-8') log_message['MESSAGE'] = final_message except Exception as error: log_message['python_error'] = 'An exception occurred: {}'.format(error) return True }; destination d_kafka_dnstap { kafka( topic("mytopic") bootstrap-servers("localhost:9092") message("$(format-flat-json --scope all-nv-pairs application_name=myapp @timestamp=${ISODATE} )") ); }; source s_net_dnstap { network( transport(udp) port(514) flags(no-parse) ); }; parser p_dnstap { channel { parser { python(class("FlattenedJson")); }; parser { json-parser(prefix("dnstap.")); }; }; }; log { source(s_net_dnstap); parser(p_dnstap); destination(d_kafka_dnstap); };

2 1

syslog-ng-3.37.1
by Laszlo Varady (lvarady) 08 Jun '22

08 Jun '22

3.37.1 Highlights * kubernetes source: A new source for Kubernetes CRI (Container Runtime Interface) format. By default it tails the /var/log/containers folder which can be overriden with the base-dir() parameter. Example configuration: source { kubernetes(); # or specifying the directory: # kubernetes(base-dir("/dir/to/tail")); }; (#4015<https://github.com/syslog-ng/syslog-ng/pull/4015>) * mariadb-audit-parser: A new parser for mariadb/mysql audit plugin logs have been added. The parser supports the syslog output type's format, see mariadb page<https://mariadb.com/kb/en/mariadb-audit-plugin> for details. (#3947<https://github.com/syslog-ng/syslog-ng/pull/3947>) Features * internal(): add rcptid tag to all trace messages that relate to incoming log messages. This makes it easier to correlate parsing, rewriting and routing actions with incoming log messages. (#3972<https://github.com/syslog-ng/syslog-ng/pull/3972>) * syslog-parser(): allow comma (e.g. ',') to separate the seconds and the fraction of a second part as some devices use that character. This change applies to both to syslog-parser() and the builtin syslog parsing functionality of network source drivers (e.g. udp(), tcp(), network() and syslog()). (#3949<https://github.com/syslog-ng/syslog-ng/pull/3949>) * cisco-parser: add ISO 8601 timestamp support (#3934<https://github.com/syslog-ng/pull/3934>) * network(), syslog() sources and destinations: added new TLS options sigalgs() and client-sigalgs() They can be used to restrict which signature/hash pairs can be used in digital signatures. It sets the "signature_algorithms" extension specified in RFC5246 and RFC8446. Example configuration: destination { network("test.host" port(4444) transport(tls) tls( pkcs12-file("/path/to/tls/test.p12") peer-verify(yes) sigalgs("RSA-PSS+SHA256:ed25519") ) ); }; (#4000<https://github.com/syslog-ng/syslog-ng/pull/4000>) * set-matches() and unset-matches(): these new rewrite operations allow the setting of match variables ($1, $2, ...) in a single operation, based on a syslog-ng list expression. Example: # set $1, $2 and $3 respectively set-matches("foo,bar,baz"); # likewise, but using a list function set-matches("$(explode ':' 'foo:bar:baz')"); (#3948<https://github.com/syslog-ng/syslog-ng/pull/3948>) * $* macro: the $* macro in template expressions convert the match variables (e.g. $1, $2, ...) into a syslog-ng list that can be further manipulated using the list template functions, or turned into a list in type-aware destinations. (#3948<https://github.com/syslog-ng/syslog-ng/pull/3948>) * set-tag(): add support for using template expressions in set-tag() rewrite operations, which makes it possible to use tag names that include macro references. (#3962<https://github.com/syslog-ng/syslog-ng/pull/3962>) Bugfixes * http() and other threaded destinations: fix $SEQNUM processing so that only local messages get an associated $SEQNUM, just like normal syslog()-like destinations. This avoids a [meta sequenceId="XXX"] SD-PARAM being added to $SDATA for non-local messages. (#3928<https://github.com/syslog-ng/syslog-ng/pull/3928>) * grouping-by(): fix grouping-by() use through parser references. Originally if a grouping-by() was part of a named parser statement and was referenced from multiple log statements, only the first grouping-by() instance behaved properly, 2nd and subsequent references were ignoring all configuration options and have reverted using defaults instead. (#3957<https://github.com/syslog-ng/syslog-ng/pull/3957>) * db-parser(): similarly to grouping-by(), db-parser() also had issues propagating some of its options to 2nd and subsequent references of a parser statement. This includes drop-unmatched(), program-template() and template() options. (#3957<https://github.com/syslog-ng/syslog-ng/pull/3957>) * match(), subst() and regexp-parser(): fixed storing of numbered (e.g. $1,$2, $3 and so on) and named capture groups in regular expressions in case the input of the regexp is the same as one of the match variables being stored. In some cases the output of the regexp was clobbered and an invalid value stored. (#3948<https://github.com/syslog-ng/syslog-ng/pull/3948>) * fix threaded(no) related crash: if threaded mode is disabled for asynchronous sources and destinations (all syslog-like drivers such as tcp/udp/syslog/network qualify), a use-after-free condition can happen due to a reference counting bug in the non-threaded code path. The threaded(yes) setting has been the default since 3.6.1 so if you are using a more recent version, you are most probably unaffected. If you are using threaded(no) a use-after-free condition happens as the connection closes. The problem is more likely to surface on 32 bit platforms due to pointer sizes and struct layouts where this causes a NULL pointer dereference. (#3997<https://github.com/syslog-ng/syslog-ng/pull/3997>) * set(): make sure that template formatting options (such as time-zone() or frac-digits()) are propagated to all references of the rewrite rule containing a set(). Previously the clone() operation used to implement multiple references missed the template related options while cloning set(), causing template formatting options to be set differently, depending on where the set() was referenced from. (#3962<https://github.com/syslog-ng/syslog-ng/pull/3962>) * csv-parser(): fix flags(strip-whitespace) and null-value handling for greedy column (#4028<https://github.com/syslog-ng/syslog-ng/pull/4028>) Other changes * java()/python() destinations: the $SEQNUM macro (and "seqnum" attribute in Python) was erroneously for both local and non-local logs, while it should have had a value only in case of local logs to match RFC5424 behavior (section 7.3.1). This bug is now fixed, but that means that all non-local logs will have $SEQNUM set to zero from this version on, e.g. the $SEQNUM macro would expand to an string, to match the syslog() driver behaviour. (#3928<https://github.com/syslog-ng/syslog-ng/pull/3928>) * dbld: add support for Fedora 35 in favour of Fedora 33 (#3933<https://github.com/syslog-ng/syslog-ng/pull/3933>) * debian: fix logrotate file not doing the file rotation. (The path and command was invalid.) (#4031<https://github.com/syslog-ng/syslog-ng/pull/4031>) * OpenSSL: add support for OpenSSL 3.0 (#4012<https://github.com/syslog-ng/syslog-ng/pull/4012>) * The MD4 hash function ($(md4)) is no longer available when compiling syslog-ng with OpenSSL v3.0. MD4 is now deprecated, it will be removed completely in future versions. (#4012<https://github.com/syslog-ng/syslog-ng/pull/4012>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Andras Mitzki, Attila Szakacs, Balazs Scheidler, Ben Burrows, Fᴀʙɪᴇɴ Wᴇʀɴʟɪ, Gabor Nagy, László Várady, mohitvaid, Parrag Szilárd, Peter Kokai, Peter Viskup, Roffild, Ryan Faircloth, Scott Parlane, Zoltan Pallagi Installation from binaries: https://github.com/syslog-ng/syslog-ng#installation-from-binaries<https://github.com/syslog-ng/syslog-ng#installation-from-binaries>

1 0