kubernetes source: A new source for Kubernetes CRI (Container Runtime Interface) format./var/log/containers folder which can be overriden with the
base-dir() parameter.source {
kubernetes();
# or specifying the directory:
# kubernetes(base-dir("/dir/to/tail"));
};
mariadb-audit-parser: A new parser for mariadb/mysql audit plugin logs have been added.syslog output type's format, see
mariadb page for details.internal(): add rcptid tag to all trace messages that relate to incoming
log messages. This makes it easier to correlate parsing, rewriting and
routing actions with incoming log messages.
(#3972)
syslog-parser(): allow comma (e.g. ',') to separate the seconds and the fraction of a
second part as some devices use that character. This change applies to both
to syslog-parser() and the builtin syslog parsing functionality of network
source drivers (e.g. udp(), tcp(), network() and
syslog()).
(#3949)
cisco-parser: add ISO 8601 timestamp support
(#3934)
network(), syslog() sources and destinations: added new TLS options
sigalgs() and client-sigalgs()
They can be used to restrict which signature/hash pairs can be used in digital signatures.
It sets the "signature_algorithms" extension specified in RFC5246 and RFC8446.
Example configuration:
destination {
network("test.host" port(4444) transport(tls)
tls(
pkcs12-file("/path/to/tls/test.p12")
peer-verify(yes)
sigalgs("RSA-PSS+SHA256:ed25519")
)
);
};
(#4000)
set-matches() and unset-matches(): these new rewrite operations allow
the setting of match variables ($1, $2, ...) in a single operation, based
on a syslog-ng list expression.
Example:
# set $1, $2 and $3 respectively
set-matches("foo,bar,baz");
# likewise, but using a list function
set-matches("$(explode ':' 'foo:bar:baz')");
(#3948)
$* macro: the $* macro in template expressions convert the match variables
(e.g. $1, $2, ...) into a syslog-ng list that can be further manipulated
using the list template functions, or turned into a list in type-aware
destinations.
(#3948)
set-tag(): add support for using template expressions in set-tag() rewrite
operations, which makes it possible to use tag names that include macro
references.
(#3962)
http() and other threaded destinations: fix $SEQNUM processing so that$SEQNUM, just like normalsyslog()-like destinations. This avoids a [meta sequenceId="XXX"] SD-PARAM$SDATA for non-local messages.grouping-by(): fix grouping-by() use through parser references.grouping-by()db-parser(): similarly to grouping-by(), db-parser() also had issuesdrop-unmatched(), program-template() andtemplate() options.match(), subst() and regexp-parser(): fixed storing of numberedthreaded(no) related crash: if threaded mode is disabled forthreaded(yes) setting has been the default since 3.6.1 so if you are usingthreaded(no) a use-after-free condition happens as the connection closes.set(): make sure that template formatting options (such as
time-zone() orfrac-digits()) are propagated to all references of the rewrite ruleset(). Previously the clone() operation used to implementset(),set() was referenced from.csv-parser(): fix flags(strip-whitespace) and
null-value handlingjava()/python() destinations: the $SEQNUM macro (and "seqnum" attribute in$SEQNUM set to zero from this version on, e.g. the
$SEQNUMdbld: add support for Fedora 35 in favour of Fedora 33$(md4)) is no longer available when compiling syslog-ng with OpenSSL v3.0.syslog-ng is developed as a community project, and as such it relies
on volunteers, to do the work necessarily to produce syslog-ng.
Reporting bugs, testing changes, writing code or simply providing
feedback are all important contributions, so please if you are a user
of syslog-ng, contribute.
We would like to thank the following people for their contribution:
Andras Mitzki, Attila Szakacs, Balazs Scheidler, Ben Burrows,
Fᴀʙɪᴇɴ Wᴇʀɴʟɪ, Gabor Nagy, László Várady, mohitvaid,
Parrag Szilárd, Peter Kokai, Peter Viskup, Roffild,
Ryan Faircloth, Scott Parlane, Zoltan Pallagi