-
Notifications
You must be signed in to change notification settings - Fork 649
/
ChangeLog
13137 lines (13105 loc) · 732 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
------------------------------------------------------------------------------
Version 8.40.0 [v8-stable] 2018-12-11
- openssl driver: improved error messages
also fixes misleading wording of some error messages
closes https://github.com/rsyslog/rsyslog/issues/3238
- imfile: disable file vs directory error on symlinks
The file/directory node-object alignment now ignores symlinks. Previously
it reported error on each directory symlink spamming user error logs.
Thanks to Jiri Vymazal for the patch.
- cleanup: remove no longer needed --enable-rtinst code
configure option --enable-rtinst is gone-away since a while, but there were
still some supporting code left. It required careful anaylsis what could
actually be removed. This is now done and the code fully cleaned up. This
greatly simplifies the code and also makes it better readable for
developers which are not deep inside the rsyslog code base.
As a positive side effect, we could eliminate mutex calls inside
the debug system. This means we are more likely to reproduce race
conditions in runs with debugging enabled.
closes https://github.com/rsyslog/rsyslog/issues/2211
- bugfix imfile: rsyslog re-sends data for files larger 2GiB
This occurs always if and only if
- reopenOnTruncate="on" is set
- file grows over 2GiB in size
Then, the data is continously re-sent until the file becomes smaller
2GiB (due to truncation) or is deleted.
It is a regression introduced by 2d15cbc8221e385c5aa821e4a851d7498ed81850
closes https://github.com/rsyslog/rsyslog/issues/3249
- config: fix segfault in backticks "echo" expansion of undefined variables
The bug was introduced in commit abe0434 (config: enhance backticks "echo"
capability). The getenv() result passed to strlen() and es_addBuf() may be
NULL if the environment variable does not exist, resulting in a segfault.
Thanks to Julien Thomas for the patch.
fixes https://github.com/rsyslog/rsyslog/issues/3006
- bugfix imsolaris: message timestamps on Solaris
On Solaris messages don't have their time directly in the raw body but in
a separate log_ctl structure which is currently not used.
When message is logged and processed, rsyslogd gives it current time because
it ignores the actual one. That means that old messages (e.g. from system
reboot) get timestamp of processing instead of the reboot itself (it is
not a problem for live logging where now is used anyway).
Thanks to Jakub Kulik for the patch.
- bugfix build system: "make distcheck" did not work for mysql tests
- bugfix build system: don't link liblogging-stdlog when available but not enabled
When liblogging-stdlog was available but configure option "--disable-liblogging-stdlog"
was set, rsyslog was still linking against liblogging-stdlog.
This commit will ensure that rsyslog will only link against liblogging-stdlog when
"--enable-liblogging-stdlog" was set.
see also: https://bugs.gentoo.org/667836
- bugfix RainerScript: abs() could return negative value, now in range [0..max]
Thanks to Harshvardhan Shrivastava for providing the patch
- bugfix debug output: date property options output wrongly
inside debug logging, the date property options were not all
properly converted into strings. Some of the newer ones were
invalidly flagged as "UNKNOWN". This is primarily a cosmetic
problem and has no effect other than puzzling folks looking at
the debug log.
- bugfix omhttp: did not compile on some platforms
- CI
* made mysql-based tests (ommysql and omlibdbi) work inside containers
* bugfix testbench: do not execute libgcrypt tests if disabled
closes https://github.com/rsyslog/rsyslog/issues/3228
* testbench: grep failed when string starting with "-" was used
The search term was mistakenly interpreted as an option.
* testbench: support auto-start/-stop of mysqld
This is required to run mysql/mariadb tests inside containers.
closes https://github.com/rsyslog/rsyslog/issues/3223
* improve bash coding style and fix a some bug in testbench
- duplicate diag.sh init call was not detected due to typo
- queue-persits test did not work correctly
- some general testbench framework improvements
issues found be shellcheck, fixes brought up other work to do
* testbench: improve journal tests and testbench framework
improving both style and reliability of journal tests; along that way
also improve testbench framework:
- do cleanup on error_exit and skip
- explicit skip handler (vs exit 77)
this permits us to do better cleanup
- new testbench functions for journal-specific functionality
reduce code duplication and make things easier to maintain in the
future
- provide a way to do valgrind and non-valgrind tests with a single
test file
see also https://github.com/rsyslog/rsyslog/issues/2564
* testbench: improve framework, harden rscript http test
- the test now tries to detect unavailable http server, which
should not result in test failure
- equivalent valgrind test changed to new methode, removing code
duplication
- testbench supports
* new exit code 177, which indicates environment error, makes
test SKIP but still reports the failure
* new exitcode, logurl stats reporting fields
* report buildbot builder (if provided) in failure report
* testbench: add test for mmjsonparse with unparsable data
* testbench: make es-bulk-retry test more reliable
We now no longer depend on a fixed 'sleep' command but rather
check the output file for what we expect. This is much more
robust on slow test machines.
We believe this closes the below-mentioned issue. If not, it
should be re-opened.
closes https://github.com/rsyslog/rsyslog/issues/3104
* testbench: suppress valgrind error caused by pthreads lib
finally I give up and honestly think this is a problem in pthreads and
not in rsyslog code. See issue below and pervious commit for more
information.
Unfortunately, this will also mask off cases where we do not properly
call pthread_join() albeit it is needed. Neverthless, this bug is
causing so much CI grief that it is definitely worth it.
closes https://github.com/rsyslog/rsyslog/issues/2902
* testbench: made a couple of (unnamed due to too many) test more robust
against slow (CI) machines
------------------------------------------------------------------------------
Version 8.39.0 [v8-stable] 2018-10-30
- imfile: improve truncation detection
previously, truncation was only detected at end of file. Especially with
busy files that could cause loss of data and possibly also stall imfile
reading. The new code now also checks during each read. Obviously, there
is some additional overhead associated with that, but this is unavoidable.
It still is highly recommended NOT to turn on "reopenOnTruncate" in imfile.
Note that there are also inherant reliability issues. There is no way to
"fix" these, as they are caused by races between the process(es) who truncate
and rsyslog reading the file. But with the new code, the "problem window"
should be much smaller and, more importantly, imfile should not stall.
see also https://github.com/rsyslog/rsyslog/issues/2659
see also https://github.com/rsyslog/rsyslog/issues/1605
- imjournal: work around journald excessive reloading behavior
This is workaround for possible imjournal interaction with systemd
where journal invalidate fix is not present. The code tries to
detect SD_JOURNAL_INVALIDATE loop and not reload after each call.
Thanks to Jiri Vymazal for the patch.
- errmsg: remove no longer needed code
refectored code (over a long time) so that object-ish style is no longer
needed and could now finally be removed; We also refactored the last
component (omhttp contrib module) that used the old interface.
closes https://github.com/rsyslog/rsyslog/issues/1684
- queue bugfix: invalid error message on queue startup
due to some old regression (commit not exactly identified, but for
sure a regression, 9 years ago it was correct) an error message
is emitted when no .qi file exists on startup of the queue, which
is a normal condition.
Actually, the code should not have tried to open the .qi file in
the first place because it detected that it did not exist. That
(necessary) shortcut had been removed a while ago.
closes https://github.com/rsyslog/rsyslog/issues/3117
- bugfix imrelp: regression with legacy configuration startup fail
Startup of a relp listener failed if legacy configuration was used.
caused by commit: 32b71daa8aadb8f16fe0ca2945e54d593f47a824
closes https://github.com/rsyslog/rsyslog/issues/3106
- bugfix imudp: stall of connection and/or potential segfault
There was a regression in 493279b790a8cdace8ccbc2c5136985e820dd2fa.
This regression may cause stop (or delay) of reception from some systems
and may also caus a segfault. Triggering condition is that at least
one listener could not be created.
Thanks to Jens Låås for the patch.
- bugfix gcry crypto driver: small memleak
If a crypto key is specified directly via the key="" parameter,
the storage for that key is not freed, causing a small memleak.
Note that the problem occurs only once per context, so this
should not cause real issues. Even more so, as specifying a
key directly is meant only for testing purposes and is strongly
discouraged for production use.
Detected by internal testing, no actual fail case known.
- fix potential misadressing in encryption subsystem
could happen if e.g. disk queues were encrypted
not seen in practice but caught by testbench test
- ksi subsystem changes
* enhance debug logging
* disable unsafe SHA1 algorithm
Thanks to Allan Park for the patch.
- bugfix core: regex compile error messages could be incorrect
- bugfix core: potential hang on rsyslog termination
The root cause was a deadlock during worker startup. This could
happen for example when a DA queue needed to persist data during
shutdown.
Fail condition:
* startup request for a new worker
* initialization of that worker
* immediate detection that the worker can or must shutdown
* main thread waiting for worker running state, which it skips,
and so the main thread hangs inside a loop
closes https://github.com/rsyslog/rsyslog/issues/3094
- bugfix imkafka: system hang when backgrounded
imkafka intializes librdkafka too early (before the fork). This leads
to hangs in various parts of the system - not only im imkafka but
other functions as well (e.g. getaddrinfo() calls).
closes https://github.com/rsyslog/rsyslog/issues/3180
- bugfix imfile: file change was not reliably detected
A change in the inode was not detected under all circumstances,
most importantly not in some logrotate cases.
Includes new tests made by Andre Lorbach. They now use the
logrotate tool natively to reproduce the issue.
closes https://github.com/rsyslog/rsyslog/issues/2659
closes https://github.com/rsyslog/rsyslog/issues/1605
- bugfix imrelp: do not fail build if librelp does not have relpSrvSetLstnAddr
closes https://github.com/rsyslog/rsyslog/issues/2938
- bugfix queue subsystem: DA queue did ignore encryption settings
closes https://github.com/rsyslog/rsyslog/issues/3066
closes https://github.com/rsyslog/rsyslog/issues/2575
- bugfix KSI: lmsig-ksils12 module skips signing the last block
Thanks to Allan Park for the patch.
closes https://github.com/rsyslog/rsyslog/issues/3105
- bugfix fmhash: function hash64mod sometimes returned wrong result
Thanks to Harshvardhan Shrivastava for providing the patch
closes https://github.com/rsyslog/rsyslog/issues/3025
- bugfix core/debug: data written to random fd 2 under some debug settings
This happens only during auto-backgrouding, where we cannot any longer
access stderr. Whatever is opened with fd2 receives some debug messages.
Note that the specific feature is usually turned on only in CI runs.
- cleanup: removed no longer needed code
Code that was unused for quite a while or did not really belong to the
project identified and removed.
- overall code cleanup
e.g. remove unused code, replace bad bash constructs, etc...
- CI:
* some small improvements in testbench plumbing
e.g. (`cmd` replaced by $(cmd), removed useless use of cat, ...)
* testbench: improve plumbing for kafka tests
- Removed all sleeps where possible.
- Moved all kafka start/stop/download logic into functions.
- Moved kafka/zookeeper stop into error_exit and exit_test.
- Kafka/Zookeeper cleanup only done on success now.
- Kafka/Zookeeper logfiles automatically dumped on error_exit only now.
- Added cleanup for Kafka/Zookeeper instances into CI/buildbot_cleanup.sh
- added new tests
* testbench: fix incompatibility of one omprog test with Python3
Python3 writes to stderr immediately, and this caused the
captured output to differ with respect to Python2. Simplified
the test to do a single write to stderr. Also a cast to int
was needed when calculating 'numRepeats'.
closes https://github.com/rsyslog/rsyslog/issues/3030
* testbench: fixed imfile parallel issues
- Fixed timing issues in some imfile wildcard/regex tests
- Added touch command in imfile wildcard tests to make sure directories
exist before files are created in it if IO is under stress.
- changed content checking in some tests to use "content_check_with_count"
with check timeouts instead of using fixed sleeptimes.
* testbench: new basic tests
These ensure that for some modules that did not have any tests at all
we have at least a minimal coverage (module loads, activates, is able
to emit error messages). Of course, further improvements would make
much sense. Modules:
- ommail
- testbench: new tests for disk queue encryption
- testbench: improved auto-diagnostics for hanging instance
- testbench: hardened kafka test against failing kafka subsyste,
not in 100% of the cases, but at least in some that frequently occur
- failing tests now report failure status so that we can get stats
on unreliable tests
- testbench tooling: fix incorrect tcpflood TLS parameter check
could lead to segfault when started
- bugfix testbench tooling: tcpflood invalid type in calloc (openssl mode)
It is unlikley that this has caused a real issue, as long as pointers
are all of the same size (what is highly probable).
detected by cppcheck via Codacy.com
------------------------------------------------------------------------------
Version 8.38.0 [v8-stable] 2018-09-18
- AIX: make basic modules work again
- make rsyslog build on AIX again
... at least for a limited set of default modules
- imfile: support for endmsg.regex
This adds support for endmsg.regex. It is similar to
startmsg.regex except that it matches the line that denotes
the end of the message, rather than the start of the next message.
This is primarily for container log file use cases such as this:
date stdout P start of message
date stdout P middle of message
date stdout F end of message
The `F` means this is the line which contains the final part of
the message. The fully assembled message should be
`start of message middle of message end of message`.
`startmsg.regex="^[^ ]+ stdout F "` will match.
Thanks to Richard Megginson for the patch.
- imkafka: add parameter "parseHostName"
This enables imkafka to parse the hostname from log message.
Previously that was not possible. It was most likely a bug, but
one that users may count on. The new parameter "ParseHostName"
(default is off) controls this behaviour. Default is to NOT
parse the hostname.
Thanks to github user snaix for the contribution.
- im[p]tcp: improve error message on connect failure
Now a message with the actual OS error is emitted, making things far
easier to troubleshoot.
- imkafka: implement multithreading support for kafka consumers.
Each consumer runs in it's own consumer thread now. New tests have also
been added for this.
- omelasticsearch: write all header metadata to $.omes for retries
Write all of the original request metadata fields to $.omes for
the retry, if present. This may include all of the following:
_index, _type, _id, _parent, pipeline
This is in addition to the fields from the response. If the same
field name exists in the request metadata and the response, the
field from the request will be used, in order to facilitate
retrying the exact same request.
Thanks to Richard Megginson for the patch.
- core: improve error message on module load fail
The error message now lists all dlopen() errors in depth. This is
especially useful if the error is due to missing symbols or file
format errors.
- core/queue: add error message if queue file cannot be accessed
When having a disk-assisted queue without permission to write to the specified
queue file an error will now be generated.
closes https://github.com/rsyslog/rsyslog/issues/323
- imtcp/imudp: new option preservecase for managing the case of FROMHOST value
default is left at current behavior
see also https://github.com/rsyslog/rsyslog/pull/2774
see also https://bugzilla.redhat.com/show_bug.cgi?id=1309698
- omprog: add feedback timeout and keep-alive feature
- Restart the program if it does not respond within timeout.
- New setting 'confirmTimeout' (default 10 seconds).
- Allow the program to provide keep-alive feedback when a
message requires long-running processing.
- Improve efficiency when reading feedback line (use buffer).
Retry interrupted writes/reads to/from pipe.
- New setting 'reportFailures' for reporting error messages
from the program.
- Report child termination when writing to pipe.
- Minor refactor: renamed writePipe function to sendMessage,
renamed readPipe to readStatus.
Thanks to Joan Sala for contributing this.
- omprog: fix forceSingleInstance configuration option
The foriceSingleInstance option did not work as intended. Even
if set multiple instances were spawned. This most probably
was a regression from 0453b1670fc34c96d31ee7c9a370f0f5ec24744a
The code was broken roughly 3.5yrs ago, so it looks like the
issue was little-noticed. This also means that potentially some users
may see the bugfix as change of behaviour. If so, just remove
the option.
closes https://github.com/rsyslog/rsyslog/issues/2813
closes https://github.com/rsyslog/rsyslog/issues/2468
Thanks to Joan Sala for contributing this.
- imfile: implement file-id, used in state file
This ensures that files with the same inodes are not accidently treated
as equal, at least within the limits of the file id hash (see doc for
details).
We use the siphash reference implementation to generate our non-cryptographic
hash.
closes https://github.com/rsyslog/rsyslog/issues/2530
closes https://github.com/rsyslog/rsyslog/issues/2231
- imfile: experimental input throtteling feature
The new input parameter delay.message has been added. It specifies
a delay in microseconds after each line read.
closes https://github.com/rsyslog/rsyslog/issues/2960
- core: emit TZ warning on startup not on Linux non-container
On Linux it seems common that the TZ variable is NOT properly set.
There are some concerns that the warning related to rsyslog correcting
this confuses users. It also seems that the corrective action rsyslog
takes is right, and so there is no hard need to inform users on that.
In Linux containers, however, the warning seems to be useful as the
timezone setup there seems to be frequently-enough different and
rsyslog's corrective action may not be correct.
So we now check if we are running under Linux and not within a container.
If so, we do not emit the warning. In all other case, we do. This is
based on the assumption that other unixoid systems still should have
TZ properly set.
closes https://github.com/rsyslog/rsyslog/issues/2994
- omkafka:
* better debug information
* Fixed minor issue in omkafka producing wrong kafka timestamps when
msgTimestamp was NULL.
* Setting RD_KAFKA_V_KEY(NULL, 0) in rd_kafka_producev now when KEY is not
configured.
* Fixed minor issue when rsyslog is compiled with --enable-debug and
librdkafka is too old.
- omfile bugfix: errant error message when dynafile param needed
also fixes related message in contributed module omfile-hardened
closes https://github.com/rsyslog/rsyslog/issues/2975
Thanks to Frank Bicknell for the patch
- omhttp: new contribued module
Thanks to Christian Tramnitz for contributing it.
Some more info at https://github.com/rsyslog/rsyslog/pull/2782
- mmkubertnetes: action fails preparation cycle if kubernetes API ...
... destroys resource during bootup sequence
The plugin was not handling 404 Not Found correctly when looking
up pods and namespaces. In this case, we assume the pod/namespace
was deleted, annotate the record with whatever metadata we have,
and cache the fact that the pod/namespace is missing so we don't
attempt to look it up again.
In addition, the plugin was not handling error 429 Busy correctly.
In this case, it should also annotate the record with whatever
metadata it has, and _not_ cache anything. By default the plugin
will retry every 5 seconds to connect to Kubernetes. This
behavior is controlled by the new config param `busyretryinterval`.
This commit also adds impstats counters so that admins can
view the state of the plugin to see if the lookups are working
or are returning errors. The stats are reported per-instance
or per-action to facilitate using multiple different actions
for different Kubernetes servers.
This commit also adds support for client cert auth to
Kubernetes via the two new config params `tls.mycert` and
`tls.myprivkey`.
Thanks to Richard Megginson for the patch.
- bugfix pmnormalize/core: several memory leaks, invld property handling
- major memory leak which occurred once per message processed
So this could lead to OOM. Caused by improper free of json
structure
- another two major leaks of similar magnitued could occur if
"fromhost-ip" and/or "fromhost" properties were set
- minor leaks upon termination. these were unproblematic as
static and only occured immediately before shutdown.
But they triggered memory debugger errors.
- fixed test which did not check for mem leaks albeit it should
- core invalid handling of the "fromhost" property, if set via
the MsgSetPropsViaJSON() call. This was primarily of concern
for pmnormalize and mmexternal, and only if these properties
were used by either the rulebase or the external program
response.
Actually, most of the leaks go back to rsyslog core, but that
core functionality was not used by other modules in the same
way. But if some other would have used it, the effects would
have been the same (so be aware if you wrote custom modules).
- bugfix imptcp: fixed pointers for session counting
imptcp open, failedopen, and closed pstats counters were assigned the wrong
name, thus pstats values did provide a totally wrong picture of what was
going on.
Thanks to github user jeverakes for the patch.
- bugfix omprog: invalid memory access on partial writes to pipe
When sending logs to the program, in case of a partial write to the pipe,
invalid data was sent, or an invalid memory access could occur. (A
partial write can occur if the syscall is interrupted or the pipe is full.)
Thanks to Joan Sala for contributing this.
- bugfix omprog: rsyslog's environment was not passed to script
closes https://github.com/rsyslog/rsyslog/issues/2921
- bugfix omprog: severity of some log messages in waitForChild corrected
Log some messages related to child process termination as info/warn
instead of error.
- bugfix imfile: files which were loaded via symlink were not always followed
They were stopped watching after being rotated.
closes https://github.com/rsyslog/rsyslog/issues/2229
Thanks to Jiri Vymazal for the patch.
- bugfix imfile: potential misadressing when processing symlinks
Fixed parent name when processing symlinks. Detected during code review.
There was a garbage byte left before which could cause errors down the
road.
Thanks to Jiri Vymazal for the patch.
- bugfix ommongodb: build issue if mongo-c-driver is not compiled with TLS
Let ommongodb module works even if mongo-c-driver is not compiled with SSL support.
Thanks to Jérémie Jourdin for the patch.
closes https://github.com/rsyslog/rsyslog/issues/2907
- CI:
* many changes with the goal to support parallel test execution, e.g.
use dynamic ports and file names, changes to testing tools, etc.
* kafka tests re-enabled, as they should now no longer be racy. However,
this has yet to be prooven in practice.
* upgrading kafka server version to current
* Fixed server configuration issues holding the kafka tests back from working
* Fixed some config issues in all sndrcv kafka tests.
* Generating dynamically kafka topics now for each kafka test.
* Renabled kafka_multi test which runs a test on 3 kafka/zookeeper instances
------------------------------------------------------------------------------
Version 8.37.0 [v8-stable] 2018-08-07
- build system: add --enable-default-tests ./configure option
This permits to control the "default tests" in testbench runs. These
are those tests that do not need a special configure option. There are
some situations where we really want to turn them of so that we can
run tests only for a specific component (e.g. ElasticSearch).
This commit also removes the --enable-testbench[12] configure switches,
which were introduced just to work-around travis runtime restrictions.
With the new CI setup and new options we could reduce the Travis runtime
dramatically and so we do not need them any longer.
- overall adaption to gcc 8 which emits new warnings
- fix some build warnings on 32bit systems, namely armhf architecture
- ommail change of behavior: "enable.body" default now "on"
This was always documented to be "on", but actually was "off". Usually, we
fix the doc, but after long discussion the agreement was that in this
specific case it was actually better to change the default.
see also: https://github.com/rsyslog/rsyslog/pull/2791
- core/omfile: race in async writing mode
mutex was not properly locked at all times when the async writing buffer
was flushed
Thanks to Radovan Sroka for the patch.
- core: provide a somewhat better default action name
We now inlcude the module name (e.g. "omelasticsearch" or "builtin:omfile")
as part of the name. This is still not perfect, but hopefully a bit
easier to grasp.
see also https://github.com/rsyslog/rsyslog/issues/342
- new global() parameter "abortOnUncleanConfig"
This provides a new-style alternative to $AbortOnUncleanConfig.
closes https://github.com/rsyslog/rsyslog/issues/2744
- tcpflood no longer links with -lgrcypt
as this is no longer necessary for GnuTLS
Thanks to Michael Biebl for the patch.
- imjournal: add journal-specific impstats counters
these provide some additional insight into journal operations
Thanks to Abdul Waheed for the patch.
- imjournal: fixed startup on missing state file
When starting rsyslog with imjournal for first time it outputs
an error and plugin does not run because no state file exists yet.
Now it skips the loading and creates state file on first persist.
Thanks to Jiri Vymazal for the patch.
- imjournal: fetching cursor on readJournal() and simplified pollJournal()
Fetching journal cursor in persistJournal could cause us to save
invalid cursor leading to duplicating messages further on, when new
WorkAroundJournalBug option is set we are saving it on each
readJournal() where we now that the state is good.
pollJournal() is now cleaner and faster, correctly handles INVALIDATE
status from journald and is able to continue polling after journal
flush. Also reduced POLL_TIMEOUT a bit as it caused rsyslog to exit
with error in corner cases for some ppc when left at full second.
re-factored imjournal CI tests with journal_print tool to have more
detailed error reporting.
Thanks to Jiri Vymazal for the patch.
- config: enhance backticks "echo" capability
This is now more along the lines of what bash does. We now support
multiple environment variable expansions as well as constant text
between them.
example:
env SOMEPATH is set to "/var/log/custompath"
config is: param=`echo $SOMEPATH/myfile`
param than is expaned to "/var/log/custompath/myfile"
among others, this is also needed inside the testbench to properly
support "make distcheck".
Note: testbench tests follows via separate commit. There will be
no special test, as the testbench itself requires the functionality
at several places, so the coverage will be very good even without
a dedicated test.
- imrelp: add support for seting address to bind to (#894)
This adds a new optional `address` parameter to `imrelp` inputs in order
to specify an address to bind to.
Based on support added by rsyslog/librelp@96eb5be
Thanks to Simon Wachter for the patch.
- omrelp: permit all authmodes; updated tests
omrelp for some time limited authentication modes to those
that were known. While this was OK, it prevented the easy
introduction of new auth modes into librel.
This has now been changed; omrelp now checks the validity of
the authmode directly via librelp by doing some librelp calls
upon processing the configuration.
Also, some tests have been updated to check this feature and
also ensure that the new librelp mode "certvalid" works
(if it is available).
- regexp.c: reduce lock contention when using glibc.
When using glibc, we enable per-thread regex to avoid lock contention.
See:
- https://github.com/rsyslog/rsyslog/issues/2759
- https://github.com/rsyslog/rsyslog/pull/2786
- https://sourceware.org/bugzilla/show_bug.cgi?id=11159
This should not affect BSD as they don't seem to take a lock in regexec.
NOTE: it is assumed that we can craft an even better solution than
this patch, but it improves the situation and we do not have time to
craft more. So we decided to merge. For details see
https://github.com/rsyslog/rsyslog/pull/2786
- mmpstrucdata: better error message, support $! in var names
see also https://github.com/rsyslog/rsyslog/issues/1262#issuecomment-404773495
- more explicit error msg with message modification mod on queue
Message modification modules do not work if used with a non-direct queue.
We now make this more explicit in the config parsing error message.
closes https://github.com/rsyslog/rsyslog/issues/1323
- omrabittmq: improve high-load performance
A different pthread mutex is created for each connection (action)
instead of a single one shared by all connections. This will
improve performance when using multiple concurrent connections
to a single (or multiple) RabbitMQ instance(s) (e.g. for load balancing)
Thanks to github user micoq for contributing the patch.
- imudp: replace select() calls by poll()
This improves reliability in extreme cases (more than 1024 fds open when
imudp begins to listen) and potentially improves performance a little.
- ommysql: support mysql unix domain socket:
via action(.. socket="/tmp/mysqld.sock" ..)
Thanks to JoungKyun Kim for contributing this.
- impstats: emit warning if log.syslog="off" and ruleset name given
With this config, "ruleset" is silently ignored, what probably is
not obvious to a user.
closes https://github.com/rsyslog/rsyslog/issues/2821
- build system cleanup: remove no longer needed --enable-memcheck
This was used for a very old testing capability, no longer functional but
causes build to fail if enabled. Replaced by ASAN/valgrind.
Issue detected while testing some other CI settings.
- tools: Updated python based statslog analyzer sample scripts
- developer tools: make devcontainer tool more developer friendly
slight improvement for easy interactive use
- enable better testing via "make distcheck"
Also a couple of changes to testbench worth mentioning:
* use cp -f to ensure files can be overwirtten in VBUILD
* fix issue of missing include test file in EXTRA_DIST
* new supressions
* testbench: try to use local system dependency cache
avoid going to Internet repos if not absolutely necessary. For
development containers, they should be pre-populated with the
important dependencies.
* do not enable libfaketime if ASAN is selected
unfortunately, libfaketime does not work in that case
Note: for modules with non-standard dependencies (e.g. databases),
"make distcheck" only enables what on the original ./configure line
was enabled. This is done in order to ensure that "distcheck" adapts
to what is actually available on the system in question. Rsyslog's
own CI system installs the maximum set of possible dependencies and
so tries the maximum set "make distcheck" can support on a platform.
see also https://github.com/rsyslog/rsyslog/issues/174
- add new global config parameter "inputs.timeout.shutdown"
- omusrmsg: do not fall back to max username length of 8
This happens if utmp.h and friends are not available and stems back to
the original syslogd. Nowadas, 32 is more appropriate and now being used
in that (now very unlikely) case. The detection logic for UT_NAMESIZE has
also been streamlined.
closes https://github.com/rsyslog/rsyslog/issues/2834
- bugfix build system: fix race in parallel builds
If libgcry.la is built later than lmcry_gcry.la, there is a failure:
[snip]
|../aarch64-wrs-linux-libtool --tag=CC --mode=link aarch64-wrs-linux-gcc
-o lmcry_gcry.la lmcry_gcry_la-lmcry_gcry.lo libgcry.la -lgcrypt
|aarch64-wrs-linux-libtool: error: cannot find the library 'libgcry.la'
or unhandled argument 'libgcry.la'
|Makefile:1049: recipe for target 'lmcry_gcry.la' failed
|make[2]: *** [lmcry_gcry.la] Error 1
[snip]
The LIBADD of lmcry_gcry.la contains libgcry.la, we should also add libgcry.la
to lmcry_gcry.la's DEPENDENCIES.
Thanks to Hongxu Jia for the patch.
- bugfix imfile: memory leak upon shutdown (cosmetic)
When rsyslog shuts down and imfile is inside a change polling loop,
it does not properly free memory returned by glob(). This is a cosmetic
bug as the process terminates within the next few milliseconds. However,
it causes memory analyzer reports and thus makes CI fail.
- bugfix core msg: potential deadlock (and rsyslog hang)
can happen e.g. with headerless messages when app-name
property is used
closes https://github.com/rsyslog/rsyslog/issues/3135
- bugfix core: do not abort startup on problems setting scheduling policy
rsyslog creates a default scheduling policy on startup. This code
invalidly used CHKiRet (our exception handler) to check pthreads
return codes, what this macro cannot do. This lead to hard to
diagnose startup problems in cases where there were problems
setting the scheduling defaults (e.g. when rsyslog is set to run
at idle priority). Even more so, this blocked startup altogether,
which is not the right thing to do. Actually, this can be considered
a regression from commit 7742b21. That commit was 8 years ago, so
in general this cannot be a big issues ;-)
The code now emits proper error messages (to stderr, as at this point
no other output is available as it is during the initial state of
rsyslog initialization) and continues the startup.
closes https://github.com/rsyslog/rsyslog/issues/2855
- bugfix core: input shutdown timeout not properly applied
The timeout could be reduced by mutex wait time, which was not the
intended behaviour and could lead the the input thread being
cancelled while it would have been perfectly legal to shut it down
cleanly.
Noticed during working on the CI system. May explain some testbench
instability and may have caused trouble with state files (not)
properly being written by inputs.
- bugfix config optimizer: error in constant folding
did not work properly if a string and a number were to be folded.
Detected by gcc 8.
- build: fix improper function casts
no real issue, but generated warnings under gcc 8 and thus
broke CI
- bugfix omlibdbi: fix potential small memory leak
detected by clang static analyzer
- bugfix ommysql: unsafe use of strncpy()
also now reports oversize names as user error vs. silent trucation
overly long names only could affect config load phase
- bugfix omhttpfs: fix insecure usage if strncmp()
consequences not evaluated as this is a contributed module.
Detected by gcc 8.
- bugfix mmgrok: cosmetic build issue - compiler warings
caused build under gcc 7 to fail with warning
- bugfix mmkubernetes: stops working with non-kubernetes container names
When mmkubernetes encounters a record with a CONTAINER_NAME field,
but the value does not match the rulebase, mmkubernetes returns
an error, and mmkubernetes does not do any further processing
of any records.
The fix is to check the return value of ln_normalize to see if
it is a "hard" error or a "does not match" error.
This also adds a test for pod names with dots in them.
Thanks to Richard Megginson for the patch.
- bugfix mmkubernetes: potential NULL pointer access
If token file could not be opened, fclose() was passed a NULL pointer.
Thanks to github user jvymazal for finding and Richard Megginson
for fixing the issue.
- bugfix omsnmp: invalid traptype was not detected
this could leave config errors unreported and cause unexpected
behaviour
- bugfix mmkubernetes: default rules use container_name_and_id
also include rulebase files in dist and fix rule so that dot inside
pod name is supported.
Thanks to Richard Megginson for fixing the issue.
- bugfix omelasticsearch: build regression
Commit 6d4635efbb13907bf651b1a6e5a545effe84d9d9 introduced some compile
problems, which were only detected on CentOS6, which unfortunately did
not compile omelasticsearch during CI runs
- bugfix ommongodb: do not force MongoDB to use "PLAIN" auth mechanism
... which also seems not to be handled by current MongoDB.
Remove ?authMechanism=PLAIN URI part to let the mongo library chooses the
default mechanism. One can force a specific authentication mechanism by
adding ?authMechanism=XXX into the uristr argument of the module
Thanks to Jérémie Jourdin for the fix.
closes https://github.com/rsyslog/rsyslog/issues/2753
- build system: do not disable tests via --disable-liblogging-stdlog
This setting controlled both the actual rsyslog functionality as well
as some testbench tests, which use liblogging-stdlog to provide some
specific functionality. This meant those tests were not run since
changing the default. Now untangling the dependency.
- CI:
* most test refactored to use newer testbench plumbing
while no functional change, this permits further enhancements
* ElasticSearch startup timeout in tests increased to care for
slower test systems
* imjournal: fixed tests to actually test plugin functionality
Thanks to Jiri Vymazal for the patch.
* new test for gnutls priority string in librelp
Thanks to github user jvymazal for the patch
* testbench: relax hanging instance detection
This does not work reliably if multiple instances of rsyslog
builds run on a single machine. We need to improve, but this
commit makes conflict less likely and provides some diagnostic
info to help guide us towards a final solution.
* testbench: fix tests that look awfully wrong
These tests indicated they terminate rsyslog forcefully without
drainging the queues, but then checked if they were drained (all
messages processed). That does not make sense, and we cannot
envison why this was written the first place. So we assume some
copy&paste problem was the root of that.
* testbench: refactor tests which used "nettester" tool
Some old tests are carried out via the nettester tool. This was
our initial shot at a testbench a couple of years ago. While it
worked back then, the testbench framework has been much enhanced.
These old tests are nowadays very hard to handle, as they miss
debug support etc. So it is time to refactor them to new style.
As a side-activity, the testbench plumbing has been enhanced to
support some operations commonly needed by these tests. Contrary
to pre-existing plumbing, these new operations are now crafted
using bash functions, which we consider superior to the current
method. So this is also the start of converting the older-style
functionality into bash functions. We just did this now because
it was required and we entangled it into the test refactoring
because it was really needed. Else we had to write old-style
operations and convert them in another commit, which would
have been a waste of time.
Special thanks to Pascal Withopf for the initial step of taking
old tests and putting config as well as test data together into
the refactored tests, on which Rainer Gerhards than could build
to create the new tests and update testbench plumbing.
* testbench: ensure uxsock test leaves no dangling listener instances
..in case the test aborts. We utilize the timeout utility for now
to prevent this.
* testbench: make port for imdiag dynamic
This is prep work to support parallel test runs
------------------------------------------------------------------------------
Version 8.36.0 [v8-stable] 2018-06-26
- build system change:
Liblogging-stdlog was introduced to provide a broader ability to send rsyslog
internal logs to different sources. However, most distros did not pick up
that capability and so instead we do a regular syslog() call. We assume that
the actual functionality is never used in practice, so we plan to retire it.
That makes building rsyslog from source easier.
The plan is to disable use of liblogging-stdlog by default during
configure. So users (and distros!) can still opt-in to have it enabled if
they desire.
A couple of releases later, we want to completely remove the functionality,
except if there has desire been shown in the meantime which justifies to keep
liblogging-stdlog.
This version disabled liblogging-stdlog by default. We now also
emit a warning message ("liblogging-stdlog will go away") so that users
know what is going on and my react.
closes https://github.com/rsyslog/rsyslog/issues/2705
see also https://github.com/rsyslog/rsyslog/issues/2706
- add openssl driver alongside GnuTLS one for TLS communication
The openssl driver is curently experimental. It will become the new preferred
driver as it permits us to provide much better end-user error message than
we could provide with GnuTLS. It is also less picky with certificate files
and provides specific error messages if there are certificate problems.
closes: https://github.com/rsyslog/rsyslog/issues/1390
closes: https://github.com/rsyslog/rsyslog/issues/1840
closes: https://github.com/rsyslog/rsyslog/issues/1352
closes: https://github.com/rsyslog/rsyslog/issues/1702
closes: https://github.com/rsyslog/rsyslog/issues/2547
- GnuTLS TLS driver: support intermediate certificates
this is necessary for certificate chains
Thanks to Arne Nordmark for providing the patch.
closes https://github.com/rsyslog/rsyslog/issues/2762
- omelasticsearch: write op types; bulk rejection retries
* Add support for a 'create' write operation type in addition to
the default 'index'. Using create allows specifying a unique id
for each record, and allows duplicate document detection.
* Add support for checking each record returned in a bulk index
request response. Allow specifying a ruleset to send each failed
record to. Add a local variable `omes` which contains the
information in the error response, so that users can control how
to handle responses e.g. retry, or send to an error file.
* Add support for response stats - count successes, duplicates, and
different types of failures.
* Add testing for bulk index rejections.
Thanks to Richard Megginson for the patch.
- lookup tables: reload message now with "info" severity (was "error")
thanks to Adam Chalkley for the patch
- imptcp: add support for regex-based framing
for complex multi-line messages (XML in particular), the multiLine method
does not work well. We now have a capability to specify via a regex when
a frame starts (and the previous thus ends).
adds imptcp input parameter "framing.delimiter.regex"
- imjournal: add statistics counter
following statistics counter are now supported by imjournal
- submitted = total number of messages submitted for processing
closes https://github.com/rsyslog/rsyslog/issues/2549
- config: permit 4-digit file creation modes
permit 4-digit file creation modes (actually 5 with the leading zero) so
that the setgid bit can also be set (and anything else on that position.
closes https://github.com/rsyslog/rsyslog/issues/1092
- ommongodb: add possibility to ignore some insertion error code
new config parameter "allowed_error_codes", which will be ignored if
they happen. For example, 11000 DuplicateKey in case of collection
containing a unique field.
Thanks to Hugo Soszynski for contributing this work
- omprog: simplify 'plugin-with-feedback.py' example
Make the skeleton easier to understand by removing transaction support.
Also, transaction failures did not work as explained in the skeleton,
because of issue #2420. In the future, a 'plugin-with-transactions.py'
example can be added, ideally once the issue is solved.
Thanks to Joan Sala for contributing this.
- core: misadressing when writing disk queue files
when writing disk queue files during shutdown, access to freed
memory can occur under these circumstances:
- action A is processing data, but could not complete it
most importantly, the current in-process batch needs not to
be totally completed. Most probable cause for this scenario
is a suspended action in retry mode.
- action A is called from a ruleset RA which
- does not have a queue assigned
- where RA is called from a ruleset RO which is bound
to the input from which the message originated
- RO must be defined before RA inside the expanded config
- Disk queues (or the disk part of a DA queue) must be utilized by A
When re-injecting the unprocessed messages from A into the disk queue, the
name of ruleset RO is accessed (for persisting to disk). However, RO is
already destructed at this point in time.
The patch changes the shutdown processing of rulesets, so that all
shutdown processing is done before any ruleset data is destructed. This
ensures that all data items which potentially need to be accessed
remain valid as long as some part may potentially try to access them.
This follows a the approach used in
https://github.com/rsyslog/rsyslog/pull/1857
where obviously that part of the problem was not noticed.
see also https://github.com/rsyslog/rsyslog/issues/1122
closes https://github.com/rsyslog/rsyslog/issues/2742
- core: fix message loss on target unavailibility during shutdown
Triggering condition:
- action queue in disk mode (or DA)
- batch is being processed by failed action in retry mode
- rsyslog is shut down without resuming action
In these cases messages may be lost by not properly writing them
back to the disk queue.
closes https://github.com/rsyslog/rsyslog/issues/2760
- imrelp bugfix: error message "librelp too old" is always emitted ...
... even if librelp is current. The codition check was actually missing.
This commit adds it.
closes https://github.com/rsyslog/rsyslog/issues/2712
- imrelp: segfault on startup when cert without priv key is configured
closes https://github.com/rsyslog/rsyslog/issues/2747
- omrelp bugfix: segfault on first message sent when authmode was wrong
A segfault could occur if the authmode was configured to an invalid value.
This is now caught during config processing and an error is reported.
closes https://github.com/rsyslog/rsyslog/issues/2743
- imfile bugfix: double-free on module shutdown
detected by code review, not seen in practice
- imfile/core bugfix: potential misadressing in string copy routine
This can be exposed via imfile, as follows:
- use a regex to process multiline messages
- configure timeouts
- make sure imfile reads a partial message
- wait so that at least one timeout occurs
- add the message termination sequence
This leads to a misadressing, which may have no obvious effects potentially
up to a segfault.
closes https://github.com/rsyslog/rsyslog/issues/2661
- imfile bugfix: if freshStartTail is set some initial file lines missing
When the option is set and a new file is created after rsyslog startup,
freshStartTail is also applied to it. That is data written quickly to it
(before rsyslog can process it) will potentially be discarded. If so,
and how much, depends on the timing between rsyslog and the logging process.
This problem is most likely to be seen in polling mode, where a relatively
long time may be required for rsyslog to find the new file.
This is changed so that now freshStartTail only applies to files that
are already-existing during rsyslog's initial processing of the file
monitors. HOWEVER, depending on the number and location (network?) of
existing files, this initial startup processing may take some time as
well. If another process creates a new file at exactly the time of
startup processing and writes data to it, rsyslog might detect this
file and it's data as prexisting and may skip it. This race is inevitable.
So when freshStartTail is used, some risk of data loss exists. The same
holds true if between the last shutdown of rsyslog and its restart log
file content has been added. This is no rsyslog bug if it occurs.
As such, the rsyslog team advises against activating the freshStartTail
option.
closes https://github.com/rsyslog/rsyslog/issues/2464
- core: fix undefined behaviour (unsigned computation may lead to value < 0)
This was detected by LLVM UBSAN. On some platforms re-setting the rawmsg
inside the message object could lead to invalid computation due to the
fact the the computation was carried out as unsigned and only then
converted to integer.
No known problem in practice.
- CI/QA:
- improved Elasticsearch tests so they can now be run without system-
installed ES service; also enables us to specify specific ES versions
and should now make the tests executable inside a container
------------------------------------------------------------------------------
Version 8.35.0 [v8-stable] 2018-05-15
- imptcp: add ability to configure socket backlog
this can be useful under heavy load.
For a detailled discussion see https://github.com/rsyslog/rsyslog/pull/2561
Thanks to Maxime Graff for implementing this.
- omfile: do not permit filename that only consists of whitespace
- fmhash: new hash function module
implements hash32() and hash64() functions
Thanks to Harshvardhan Shrivastava for implementing these
- some better error messages
- imklog: add ratelimiting capability
On Linux kernel logs are ratelimited only for messages using
printk_ratelimit(). Some logs do not use this facility, so
we ratelimit kernel ourselves.
Thanks to Berend De Schouwer for the patch.
- omkafka: added impstats counters for librdkafka returned statistics
Adds:
* statscallback counters
* librdkafka failure and error counters
* acked message counter
Thanks to Abdul Waheed for implementing this.
- imudp
* use rsyslog message rate-limiter instead of home-grown one
imudp introduced it's own (feature-limited) rate-limiting capability for
message on disallowed senders before we had central rate-limiters
inside rsyslog. Also, that code evolved from running on a single
thread to running on multiple threads, which introduced data races
and so made unreliable.
Now we removed the old rate-limiting capability and depend on the
system rate limiter for internal rsyslog messages.
closes https://github.com/rsyslog/rsyslog/issues/2467
* add stats counter "disallowed"
counts the number of messages discarded due to being received from
disallowed senders
see also https://github.com/rsyslog/rsyslog/issues/2467
- imrelp: add parameter "oversizeMode"
Permits to instruct librelp how to handle oversize messages. The new default
is to truncate messages. Previously, the connection was aborted, what often
lead to stuck messages at the sender side. Now, there are three options passed
down to librelp:
* abort - same behavior as previously, connection is aborted on error
* truncate - do not abort but instead truncate oversize message to
configured max size
* accept - accept all oversize messages (note: this can cause security issues,
see doc for details)
see also https://github.com/rsyslog/rsyslog/pull/1525#issuecomment-384179393
see also https://github.com/rsyslog/rsyslog/issues/2190
closes https://github.com/rsyslog/rsyslog/issues/2633
closes https://github.com/rsyslog/rsyslog/issues/1741
closes https://github.com/rsyslog/rsyslog/issues/1782
closes https://github.com/rsyslog/rsyslog/issues/2496
- core: consistent handling of oversize input messages
In the community we frequently discuss handling of oversize messages.
David Lang rightfully suggested to create a central capability inside
rsyslog core to handle them.
We need to make a distinction between input and output messages. Also,
input messages frequently need to have some size restrictions done at
a lower layer (e.g. protocol layer) for security reasons. Nevertheless,
we should have a central capability
* for cases where it need not be handled at a lower level
* as a safeguard when a module invalidly emits it (imfile is an example,
see https://github.com/rsyslog/rsyslog/pull/2632 for a try to fix it
on the module level - we will replace that with the new capability
described here).
The central capability works on message submission, and so cannot be
circumvented. It has these capabilities:
* overisze message handling modes:
- truncate message
- split message
this is of questionable use, but also often requested. In that mode,
the oversize message content is split into multiple messages. Usually,
this ends up with message segments where all but the first is lost
anyhow as the regular filter rules do not match the other fragments.
As it is requested, we still implemented it.
- accept message as is, even if oversize
This may be required for some cases. Most importantly, it makes
quite some sense when writing messages to file, where oversize
does not matter (accept from a DoS PoV).
* report message to a special "oversize message log file" (not via the
regular engine, as that would obviously cause another oversize message)
This commit, as the title says, handles oversize INPUT messages.
see also https://github.com/rsyslog/rsyslog/issues/2190
closes https://github.com/rsyslog/rsyslog/issues/2681
closes https://github.com/rsyslog/rsyslog/issues/498
Note: this commit adds global parameters:
* "oversizemsg.errorfile",
is used to specify the location of the oversize message log file.
* "oversizemsg.report",
is used to control if an error shall be reported when an oversize
message is seen. The default it "on".
* add global parameter "oversizemsg.input.mode"
is used to specify the mode with which oversized messages will
be handled.
- omfwd: add support for bind-to-address for UDP
To allow the same source address to be used regardless of the egress
interface taken, an option is added for an address to bind the datagram
socket to. Similarly to imudp, it is necessary to add an ipfreebind
option which is set by default, so as to avoid an excess of errors at
startup before the network interface has come up. This enhancement
allows a usecase on networking devices, by which a source interface
that is typically a loopback is specified, on which an address to bind
to is configured. This is so that the same source address is used for
all packets from rsyslog.
Thanks to Mike Manning for the patch.
- template systemd service file proposes higher permitted file handle limit
Especially on busy systems the default are too low. Please keep in mind