Skip to content

v0.9.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Oct 05:17
· 82 commits to main since this release
v0.9.2
32c6fac

Trawl 0.9.2

Trawl collects and searches logs for homelabs and small installations. Run one
Linux server, send it events over HTTP or syslog, and search them from a browser,
the command line, or the terminal UI.

This release fixes what a from-scratch install of 0.9.1 found when its
documentation was followed word for word on Debian 13 and on Kubernetes. It
also reads zone-less syslog timestamps in a configured zone.

What is included

  • The syslog listener reads an RFC 3164 timestamp that carries no offset in
    [syslog] default_timezone, or in UTC when that is unset. Set one zone for
    a peer with [syslog.sender_timezones].
  • The Debian package ships the Vector configurations under
    /usr/share/doc/trawl-server/examples/vector/. The sender guide pins the
    Vector version it is tested with and keeps the ingest key in its own
    environment file.
  • The installation guides work as written on Debian and Helm. They cover
    installing PostgreSQL, a reverse proxy for the browser, an operator role
    for ingest preview, curl configuration files that keep tokens off the
    command line, and a first query on your own server. Commands that install
    a chart or copy a file name this release.

Fixes

  • trawld keeps its stored data owner-only on every install channel. It sets
    its own file-creation mask, and at each start it closes its data and
    write-ahead-log directories to its own user. The Debian unit keeps
    /var/lib/trawl at 0750 and /var/log/trawl at 0700 across restarts.
  • A request body over the configured limit is refused with a 413 that names
    the setting. When the server closes the connection during an upload, the
    CLI says so, instead of reporting a generic network error. The configured
    body limits are now the real limits.
  • The Helm chart passes Pod Security restricted when crash dumps are off,
    including its test pod. fleet-admin works inside the trawld container as
    the access guide shows. httpRoute can route to the browser proxy.
  • trawld and trawl-web colour their log lines only on a terminal, and never
    when NO_COLOR is set.

Existing installations

0.9.2 keeps the 0.9.0 storage epoch and database baseline. The server applies
forward migrations at startup.

trawld refuses to start when it cannot close its data or write-ahead-log
directory to its own user, for example when another user owns it. Run
trawld --doctor before you upgrade. A directory it will tighten reports
will_tighten.

On a Debian host that is not on UTC, a sender that logs RFC 3164 local time
without an offset now lands in UTC. Set [syslog] default_timezone to the
senders' zone before you restart trawld. trawld now checks the syslog peer
settings at startup even when the listener is off: a source_service_map key
that is not an IP address, or a malformed allow_cidrs entry, refuses to
start. Run trawld --check-config first.

In the Helm chart, httpRoute.backend now defaults to web, the browser
proxy, like ingress.backend. A route that should reach the HTTPS API needs
httpRoute.backend: trawld. The pod sets seccompProfile: RuntimeDefault.
Crash-dump mode still adds SYS_PTRACE to trawld, so its namespace must
allow that capability.

Installation choices

Platform Available components
Linux amd64 and arm64 Server and CLI archives, Debian packages, and container images
macOS 15 or newer, Apple silicon and Intel CLI archives
Kubernetes Helm chart for the Linux server and browser

Linux packages target Debian 12. Archives include the DuckDB runtime; keep
their bin/ and lib/trawl/ directories together. macOS archives use ad-hoc
signatures and are not Apple Developer ID signed or notarized.

Start with the installation guide and
your first query.

Requirements and scope

A server needs persistent storage and PostgreSQL, with separate databases for
authentication and application state. Clients need an API key with the required
permissions and trust in the server's TLS certificate. The browser requires
its own public origin and persistent session key.

Trawl is designed for one node. It does not provide clustering, sharding, or
multi-tenancy. Storage and memory needs depend on ingest volume, retention,
and queries.

Assets 16
Loading