[syslog-ng] Version 4.8.1 of syslog-ng is now available
Peter Czanik (pczanik)
Peter.Czanik at oneidentity.com
Thu Oct 3 14:15:33 UTC 2024
Hi,
I'm happy to share that version 4.8.1 of syslog-ng is now available. The focus of this release was bug fixing, but there are a few minor new features also available, like MacPorts support and ElasticSearch datastream support.
Please help to spread the word, and share / retweet the release announcement on social media:
*
https://www.linkedin.com/posts/peterczanik_release-syslog-ng-481-syslog-ngsyslog-ng-activity-7247605227082698753-7Olc
*
https://fosstodon.org/@PCzanik/113243820863895946
*
https://x.com/PCzanik/status/1841838695659274333
For a complete list of changes you can read the release notes:
Highlights
*
elasticsearch-datastream() destinations can be used to feed Elasticsearch data streams<https://www.elastic.co/guide/en/elasticsearch/reference/current/data-streams.html>.
Example config:
elasticsearch-datastream(
url("https://elastic-endpoint:9200/my-data-stream/_bulk")
user("elastic")
password("ba3DI8u5qX61We7EP748V8RZ")
);
*
(#5069<https://github.com/syslog-ng/syslog-ng/pull/5069>)
*
building: thanks to Sergey Fedorov and Marius Schamschula, macOS builds now support gcc again. They also updated the MacPort version<https://github.com/macports/macports-ports/blob/30c55ba04d8c0693c18cdf84014187cd3c53e60f/sysutils/syslog-ng-devel/Portfile> of syslog-ng (develop). Great work, and thank you so much for your contribution!
(#5108<https://github.com/syslog-ng/syslog-ng/pull/5108>)
Features
*
tls(): expose the key fingerprint of the peer in ${.tls.x509_fp} if
trusted-keys() is used to retain the actual peer identity in the received
messages.
(#5068<https://github.com/syslog-ng/syslog-ng/pull/5068>)
*
syslog-parser: Added the no-piggyback-errors and the piggyback-errors flags to control whether the message retains the original message or not on parse error(s). By default the old behaviour/piggyback-errors flag is active.
The following new tags can be added by the syslog-parser to the message when the parsing failed:
* no-piggyback-errors: On failure, the original message will be left as it was before parsing, the value of $MSGFORMAT will be set to syslog-error, and a tag will be placed on the message corresponding to the parser's failure.
* piggyback-errors: On failure, the old behaviour is used (clearing the entire message then syslog-ng will generate a new message in place of the old one describing the parser's error).
* syslog.rfc5424_missing_hostname
* syslog.rfc5424_missing_app_name
* syslog.rfc5424_missing_procid
* syslog.rfc5424_missing_msgid
* syslog.rfc5424_missing_sdata
* syslog.rfc5424_invalid_sdata
* syslog.rfc5424_missing_message
(#5063<https://github.com/syslog-ng/syslog-ng/pull/5063>)
Bugfixes
*
syslog-ng-ctl: fix escaping of stats prometheus
Metric labels (for example, the ones produced by metrics-probe()) may contain control characters, invalid UTF-8 or \
characters. In those specific rare cases, the escaping of the stats prometheus output was incorrect.
(#5046<https://github.com/syslog-ng/syslog-ng/pull/5046>)
*
wildcard-file(): fix crashes can occure if the same wildcard file is used in multiple sources
Because of some persistent name construction and validation bugs the following config crashed syslog-ng
(if there were more than one log file is in the /path folder)
@version: current
@include "scl.conf"
source s_files1 {
file("/path/*.log"
persist-name("p1")
);
};
source s_files2 {
file("/path/*.log"
persist-name("p2")
);
};
destination s_stdout {
stdout();
};
log {
source(s_files1);
destination(s_stdout);
};
log {
source(s_files2);
destination(s_stdout);
};
*
NOTE:
* The issue occurred regardless of the presence of the persist-name() option.
* It affected not only the simplified example of the legacy wildcard file() but also the new wildcard-file() source.
(#5091<https://github.com/syslog-ng/syslog-ng/pull/5091>)
*
syslog-ng-ctl: fix crash of syslog-ng service in g_hash_table lookup function after syslog-ng-ctl reload
(#5087<https://github.com/syslog-ng/syslog-ng/pull/5087>)
*
file(), stdout(): fix log sources getting stuck
Due to an acknowledgment bug in the file() and stdout() destinations,
sources routed to those destinations may have gotten stuck as they were
flow-controlled incorrectly.
This issue occured only in extremely rare cases with regular files, but it
occured frequently with /dev/stderr and other slow pseudo-devices.
(#5134<https://github.com/syslog-ng/syslog-ng/pull/5134>)
*
directory-monitor: fixed a main thread assertion crash that might have occurred during syslog-ng stop or restart
(#5086<https://github.com/syslog-ng/syslog-ng/pull/5086>)
*
Config @version: fixed compat-mode inconsistencies when @version was not specified at the top of the configuration
file or was not specified at all
(#5145<https://github.com/syslog-ng/syslog-ng/pull/5145>)
*
grpc: Fix potential memoryleak when the grpc module is loaded but not used.
(#5062<https://github.com/syslog-ng/syslog-ng/pull/5062>)
*
s3(): Eliminated indefinite memory usage increase for each reload.
The increased memory usage is caused by the botocore library, which
caches the session information. We only need the Session object, if
role() is set. The increased memory usage still happens with that set,
currently we only fixed the unset case.
(#5149<https://github.com/syslog-ng/syslog-ng/pull/5149>)
*
opentelemetry() sources: fix crash when workers() is set to > 1
(#5138<https://github.com/syslog-ng/syslog-ng/pull/5138>)
*
opentelemetry() sources: fix source hang-up on flow-controlled paths
(#5148<https://github.com/syslog-ng/syslog-ng/pull/5148>)
*
metrics-probe(): fix disappearing metrics from stats prometheus output
metrics-probe() metrics became orphaned and disappeared from the syslog-ng-ctl stats prometheus output
whenever an ivykis worker stopped (after 10 seconds of inactivity).
(#5075<https://github.com/syslog-ng/syslog-ng/pull/5075>)
*
affile: Fix an invalid lseek call mainly on the pipe() source, but also possible if using affile on pipe like files (pipe, socket and FIFO).
(#5058<https://github.com/syslog-ng/syslog-ng/pull/5058>)
Other changes
*
format-json: spaces around = in $(format-json) template function could cause a
crash<https://github.com/syslog-ng/syslog-ng/issues/5065>.
The fix of the issue also introduced an enhancement, from now on spaces are allowed
around the = operator, so the following $(format-json) template function calls
are all valid:
$(format-json foo =alma)
$(format-json foo= alma)
$(format-json foo = alma)
$(format-json foo=\" alma \")
$(format-json foo= \" alma \")
$(format-json foo1= alma foo2 =korte foo3 = szilva foo4 = \" meggy \" foo5=\"\")
*
Please note the usage of the escaped strings like \" meggy \", and the (escaped and) quoted form
that used for an empty value \"\", the latter is a breaking change as earlier an expression like
key= led to a json key-value pair with an empty value {"key":""} that will not work anymore.
(#5080<https://github.com/syslog-ng/syslog-ng/pull/5080>)
*
building: fixed multiple potentional FreeBSD build errors
(#5099<https://github.com/syslog-ng/syslog-ng/pull/5099>)
*
docker: Changed the container image's base to debian:bookworm.
(#5056<https://github.com/syslog-ng/syslog-ng/pull/5056>)
Credits
syslog-ng is developed as a community project, and as such it relies
on volunteers, to do the work necessarily to produce syslog-ng.
Reporting bugs, testing changes, writing code or simply providing
feedback are all important contributions, so please if you are a user
of syslog-ng, contribute.
We would like to thank the following people for their contribution:
Andras Mitzki, Attila Szakacs, Balazs Scheidler, Hofi,
Kovács Gergő Ferenc, László Várady, Mate Ory,
Peter Czanik (CzP), Sergey Fedorov, Marius Schamschula, Szilard Parrag,
Tamas Pal, shifter
Peter Czanik (CzP) <peter.czanik at oneidentity.com>
Balabit (a OneIdentity company) / syslog-ng upstream
https://syslog-ng.com/community/
https://twitter.com/PCzanik
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20241003/1c51dc9d/attachment-0001.htm>
More information about the syslog-ng
mailing list