Re: syslog-ng version 4.9.0 is now available
"Peter Czanik (pczanik)" <[email protected]> Mon, 25 Aug 2025 09:16:35 +0000
| Newsgroups | gmane.comp.syslog-ng |
|---|---|
| Message-ID | <CO1PR19MB512606749CC4D4C083686EB68B3EA@CO1PR19MB5126.namprd19.prod.outlook.com> |
--===============6217140853942008318== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_CO1PR19MB512606749CC4D4C083686EB68B3EACO1PR19MB5126namp_" --_000_CO1PR19MB512606749CC4D4C083686EB68B3EACO1PR19MB5126namp_ Content-Type: text/plain; charset="windows-1250" Content-Transfer-Encoding: quoted-printable Hi Gyula, Thanks for the report! I talked to the developer, who worked on it, and it = is not a known issue. Please open a GitHub issue at https://github.com/sysl= og-ng/syslog-ng/issues/ for easier tracking, and also attach a minimal conf= iguration to reproduce the problem, together with some information about yo= ur environment (number of log source hosts, message rate, etc.). Thanks, Peter Peter Czanik (CzP) <[email protected]> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik ________________________________ From: Kerekes Gyula <[email protected]> Sent: Friday, August 22, 2025 10:35 To: [email protected] <[email protected]> Subject: [syslog-ng]Re: syslog-ng version 4.9.0 is now available CAUTION: This email originated from outside of the organization. Do not fol= low guidance, click links, or open attachments unless you recognize the sen= der and know the content is safe. Hi, I tried this stats exporter-dont-log() feature and it works well but it see= ms like it has a mem leak somewhere. I tried to switch off the prometheus d= ata collection to one of the syslog-ng hosts and the mem consumption stayed= fairly low. On the other hand all the others used 1-2 gigs of RSS mem. Is = it a known issue? Gyula 2025. 07. 17. 15:19 keltez=E9ssel, Peter Czanik (pczanik) =EDrta: Hi, I am happy to announce that version 4.9.0 of syslog-ng is now available. Th= anks everyone who contributed code, documentation, testing, or in any other= way. Peter 4.9.0 Highlights * stats-exporter: Added two new sources, stats-exporter() and stats-exporter-= dont-log(), which directly serve the output of syslog-ng-ctl stats and sysl= og-ng-ctl query to a http scraper. The only difference is that stats-export= er-dont-log() suppresses log messages from incoming scraper requests, ensur= ing no messages appear in the log path. Meanwhile, stats-exporter() logs un= parsed messages, storing incoming scraper HTTP requests in the MSG field. Example usage for a Prometheus Scraper which logs the HTTP request of the s= craper to /var/log/scraper.log: @version: 4.9 @include "scl.conf" source s_prometheus_stat { stats-exporter( ip("0.0.0.0") port(8080) stat-type("query") stat-query("*") scrape-freq-limit(30) single-instance(yes) ); }; log { source(s_prometheus_stat); destination { file(/var/log/scraper.log); }; }; Example usage for a generic HTTP Scraper which sends e.g. the GET /stats HT= TP/1.1 HTTP request to get statistics of syslog-ng, do not want to log or f= urther process the HTTP requests in the log pipe, and needs the response in= CSV format: @version: 4.9 @include "scl.conf" source s_scraper_stat { stats-exporter-dont-log( ip("0.0.0.0") port(8080) stat-type("stats") stat-format("csv") scrape-pattern("GET /stats*") scrape-freq-limit(30) single-instance(yes) ); }; log { source(s_scraper_stat); }; Note: A destination is not required for this to work; the stats-exporter() = source will respond to the scraper regardless of whether a destination is p= resent in the log path. Available options: stat-type(string) - query or stats, just like for the syslog-ng-ctl command= line tool, see there for the details stat-query(string) - the query regex string that can be used to filter the = output of a query type request stat-format(string) - the output format of the given stats request, like th= e -m option of the syslog-ng-ctl command line tool scrape-pattern(string) =96 the pattern used to match the HTTP header of inc= oming scraping requests. A stat response will be generated and sent only if= the header matches the pattern string scrape-freq-limit(non-negative-int) - limits the frequency of repeated scra= per requests to the specified number of seconds. Any repeated request withi= n this period will be ignored. A value of 0 means no limit single-instance(yes/no) - if set to yes only one scraper connection and req= uest will be allowed at once (#5259<https://github.com/syslog-ng/syslog-ng/pull/5259>) * syslog() source driver: add support for RFC6587 style auto-detection of octet-count based framing to avoid confusion that stems from the sender using a different protocol to the server. This behaviour can be enabled by using transport(auto) option for the syslog() source. (#5322<https://github.com/syslog-ng/syslog-ng/pull/5322>) * wildcard-file: Added inotify-based regular file change detection using the = existing inotify-based directory monitor. This improves efficiency on OSes like Linux, where only polling was availab= le before, significantly reducing CPU usage while enhancing change detectio= n accuracy. To enable this feature, inotify kernel support is required, along with moni= tor-method() set to inotify or auto, and follow-freq() set to 0. (#5315<https://github.com/syslog-ng/syslog-ng/pull/5315>) Features * cisco: Added support for Cisco Nexus NXOS 9.3 syslog format. The parser now recognises NXOS 9.3 timestamps in YYYY MMM DD HH:MM:SS forma= t and handles the different sequence number prefix (: instead of seqno: ) used by NXOS 9.3 compared to = traditional IOS formats. Example Cisco configuration: Example syslog-ng configuration: @include "scl.conf" source s_cisco { network(ip(0.0.0.0) transport("udp") port(2000) flags(no-parse)); }; parser p_cisco { cisco-parser(); }; destination d_placeholder { # Define your destination here }; log { source(s_cisco); parser(p_cisco); destination(d_placeholder); }; (#5412<https://github.com/syslog-ng/syslog-ng/pull/5412>) * NXOS: (config)# logging server <syslog-ng-server-ip> port 2000 * IOS: (config)# logging host <syslog-ng-server-ip> transport udp po= rt 2000 * bigquery(), google-pubsub-grpc(): Added service-account() authentication op= tion. Example usage: destination { google-pubsub-grpc( project("test") topic("test") auth(service-account(key ("path_to_service_account_key.json"))) ); }; Note: In contrary to the http() destination's similar option, we do not need to manually set the audience here as it is automatically recognized by the underlying gRPC API. (#5270<https://github.com/syslog-ng/syslog-ng/pull/5270>) * gRPC based destinations: Added response-action() option With this option, it is possible to fine tune how syslog-ng behaves in case of different gRPC results. Supported by the following destination drivers: Supported gRPC results: Supported actions: Usage: google-pubsub-grpc( project("my-project") topic("my-topic") response-action( not-found =3D> disconnect unavailable =3D> drop ) ); (#5332<https://github.com/syslog-ng/syslog-ng/pull/5332>) * opentelemetry() * loki() * bigquery() * clickhouse() * google-pubsub-grpc() * ok * unavailable * cancelled * deadline-exceeded * aborted * out-of-range * data-loss * unknown * invalid-argument * not-found * already-exists * permission-denied * unauthenticated * failed-precondition * unimplemented * internal * resource-exhausted * disconnect * drop * retry * success * s3: Added two new options Example: s3( url("http://localhost:9000"<http://localhost:9000>) bucket("testbucket") object_key("testobject") access_key("<ACCESS_KEY_ID>") secret_key("<SECRET_ACCESS_KEY>") content_type("text/plain") use_checksum("when_required") ); (#5286<https://github.com/syslog-ng/syslog-ng/pull/5286>) * content-type(): users now can change the content type of the objec= ts uploaded by syslog-ng. * use_checksum(): This option allows the users to change the default= checksum settings for S3 compatible solutions that don't support checksums. Requires botocore 1.3= 6 or above. Acceptable values are when_supported (default) and when_required. * loki(): Added batch-bytes() and compression() options. (#5174<https://github.com/syslog-ng/syslog-ng/pull/5174>) * syslog-ng-ctl: Formatting the output of the syslog-ng-ctl stats and syslog-= ng-ctl query commands is unified. Both commands got a new --format (-m) argument that can control the output = format of the given stat or query. The following formats are supported: * kv - the legacy key-value-pairs e.g. center.queued.processed=3D0 (= only for the query command yet) * csv - comma separated values e.g. center;;queued;a;processed;0 * prometheus - the prometheus scraper ready format e.g. syslogng_cen= ter_processed{stat_instance=3D"queued"} 0 (#5248<https://github.com/syslog-ng/syslog-ng/pull/5248>) * network(), syslog() sources: add $PEERIP and $PEERPORT macros The $PEERIP and $PEERPORT macros always display the address and port of the= direct sender. In most cases, these values are identical to $SOURCEIP and $SOURCEPORT. However, when dealing with proxied protocols, $PEERIP and $PEERPORT reflect= the proxy's address and port, while $SOURCEIP and $SOURCEPORT indicate the original source of the message= . (#5291<https://github.com/syslog-ng/syslog-ng/pull/5291>) * webhook(),opentelemetry() sources: support input_event_bytes metrics (#5324<https://github.com/syslog-ng/syslog-ng/pull/5324>) * freebsd-audit(): added a simple source SCL to collect FreeBSD audit logs us= ing the built-in praudit program https://www.syslog-ng.com/community/b/blog/posts/freebsd-audit-source-for-s= yslog-ng (#5383<https://github.com/syslog-ng/syslog-ng/pull/5383>) * webhook(): headers support include-request-headers(yes) stores request headers under the ${webhook.hea= ders} key, allowing further processing proxy-header("x-forwarded-for") helps retain the sender's original IP and t= he proxy's IP address ($SOURCEIP, $PEERIP). (#5333<https://github.com/syslog-ng/syslog-ng/pull/5333>) * check-program: Introduced as a flag for global or source options. By default, this flag is set to false. Enabling the check-program flag trig= gers program name validation for RFC3164 messages. Valid program names must= adhere to the following criteria: Contain only these characters: [a-zA-Z0-9-_/().] Include at least one alphabetical character. If a program name fails validation, it will be considered part of the log m= essage. Example: source { network(flags(check-hostname, check-program)); }; (#5264<https://github.com/syslog-ng/syslog-ng/pull/5264>) * syslog(transport(proxied-*)) and network(transport(proxied-*)): changed where HAProxy transport saved the original source and destination addresses= . Instead of using dedicated PROXIED_* name-value pairs, use the usual $SOURCEIP, $SOURCEPORT, $DESTIP and $DESTPORT macros, making haproxy based connections just like native ones. $SOURCEPORT: added new macro which expands to the source port of the peer. (#5305<https://github.com/syslog-ng/syslog-ng/pull/5305>) * opentelemetry(), syslog-ng-otlp(): Added keep-alive() options. Keepalive can be configured with the time(), timeout() and max-pings-without-data() options of the keep-alive() block. opentelemetry( ... keep-alive(time(20000) timeout(10000) max-pings-without-data(0)) ); (#5174<https://github.com/syslog-ng/syslog-ng/pull/5174>) * bigquery(): Added auth() options. Similarly to other gRPC based destination drivers, the bigquery() destination now accepts different authentication methods, like adc(), alts(), insecure() and tls(). bigquery ( ... auth( tls( ca-file("/path/to/ca.pem") key-file("/path/to/key.pem") cert-file("/path/to/cert.pem") ) ) ); (#5174<https://github.com/syslog-ng/syslog-ng/pull/5174>) * cloud-auth: Added azure-monitor() destination Added oauth2 authentication for azure monitor destinations. Example usage: azure-monitor( dcr-id("dcr id") dce-uri("dce uri") stream_name("stream name") auth( tenant-id("tenant id") app-id("app id") app-secret("app secret") ) ) (#5293<https://github.com/syslog-ng/syslog-ng/pull/5293>) * multi-line-mode(): Added a new mutiline detection mode empty-line-separated= that, as its name suggests, reads and treats all messages as one till it r= eceives an empty line (which contains only a \r, \n or \r\n sequence). (#5259<https://github.com/syslog-ng/syslog-ng/pull/5259>) * google-pubsub-grpc(): Added a new destination that sends logs to Google Pub= /Sub via the gRPC interface. Example config: google-pubsub-grpc( project("my_project") topic($topic) data($MESSAGE) attributes( timestamp =3D> $S_ISODATE, host =3D> $HOST, ) workers(4) batch-timeout(1000) # ms batch-lines(1000) ); The project() and topic() options are templatable. The default service endpoint can be changed with the service_endpoint() opt= ion. (#5266<https://github.com/syslog-ng/syslog-ng/pull/5266>) * ivykis: We have switched to our own fork<https://github.com/balabit/ivykis>= of ivykis as the source for builds when using syslog-ng=92s internal ivyki= s option (--with-ivykis=3Dinternal in autotools or -DIVYKIS_SOURCE=3Dintern= al in CMake). We recommend switching to this internal version, as it includes new feature= s not available in the original version<https://github.com/buytenh/ivykis> = and likely never will be. (#5307<https://github.com/syslog-ng/syslog-ng/pull/5307>) * ivykis: Fixed and merged the in development phase io_uring based polling me= thod solution to our ivykis fork<https://github.com/balabit/ivykis>. This is am experimental integration and not selected by default, you must a= ctivate it directly either using the IV_EXCLUDE_POLL_METHOD or IV_SELECT_PO= LL_METHOD as described here<https://syslog-ng.github.io/admin-guide/060_Sou= rces/020_File/001_File_following>. (#5312<https://github.com/syslog-ng/syslog-ng/pull/5312>) * file(), wildcard-file(): Added follow-method() option. |Accepted values:| legacy | inotify | poll | system | This option controls how syslog-ng will follow file changes. The default legacy mode preserves the pre-4.9 version file follow-mode beha= vior of syslog-ng, which is based on the value of follow-freq(). The poll value forces syslog-ng to poll for file changes at the interval sp= ecified by the monitor-freq() option, even if a more efficient method (such= as inotify or kqueue) is available. If inotify is selected and supported by the platform, syslog-ng uses it to = detect changes in source files. This is the most efficient and least resour= ce-consuming option available on Linux for regular files. The system value will use system poll methods (via ivykis) like port-timer = port dev_poll epoll-timerfd epoll kqueue ppoll poll and uring. For more inf= ormation about how to control the system polling methods used, see How cont= ent changes are followed in file() and wildcard-file() sources<https://sysl= og-ng.github.io/admin-guide/060_Sources/020_File/001_File_following>. (#5338<https://github.com/syslog-ng/syslog-ng/pull/5338>) * opentelemetry(), loki() destination: Add support for templated header() val= ues (#5184<https://github.com/syslog-ng/syslog-ng/pull/5184>) Bugfixes * syslog-ng-otlp() destination: Fixed a crash. (#5267<https://github.com/syslog-ng/syslog-ng/pull/5267>) * Fixed some time parsing and time formatting issues. (#5386<https://github.com/syslog-ng/syslog-ng/pull/5386>) * syslogformat: Fix integer overflow on set pri (#5254<https://github.com/syslog-ng/syslog-ng/pull/5254>) * network(), syslog(): Fixed a potential crash for TLS destinations during re= load In case of a TLS connection, if the handshake didn't happen before reloadin= g syslog-ng, it crashed on the first message sent to that destination. (#5303<https://github.com/syslog-ng/syslog-ng/pull/5303>) * collectd(): fix not reading server responses (#5390<https://github.com/syslog-ng/syslog-ng/pull/5390>) * metrics: syslog-ng-ctl --reset will no longer reset Prometheus metrics (#5261<https://github.com/syslog-ng/syslog-ng/pull/5261>) * rate-limit(): fix precision issue that could occur at a very low message ra= te (#5346<https://github.com/syslog-ng/syslog-ng/pull/5346>) * network(), syslog() sources and destinations: fix TCP/TLS shutdown (#5271<https://github.com/syslog-ng/syslog-ng/pull/5271>) * http: Fixed a batching related bug that happened with templated URLs and a = single worker. (#5281<https://github.com/syslog-ng/syslog-ng/pull/5281>) * network(), syslog() destinations: handle async TLS messages (KeyUpdate, etc= .) (#5390<https://github.com/syslog-ng/syslog-ng/pull/5390>) Notes to developers * editorconfig: configure supported editors for the project's style (#5331<https://github.com/syslog-ng/syslog-ng/pull/5331>) Other changes * java-modules: Upgrade java common and hdfs dependencies. (#5366<https://github.com/syslog-ng/syslog-ng/pull/5366>) * java-modules: Remove depricated java destinations: elasticsearch2, kafka-ja= va and the java-http. The following destinations can be used instead: * elasticsearch2 - Both elastic-datastream()<https://syslog-ng.githu= b.io/admin-guide/070_Destinations/035_elasticsearch-datastream/README> or t= he elastic-http()<https://syslog-ng.github.io/admin-guide/070_Destinations/= 030_Elasticsearch-http/README> can be used. * kafka-java - The C based kafka-c()<https://syslog-ng.github.io/adm= in-guide/070_Destinations/100_Kafka-c/README> destination can be used inste= ad. To help with migration check out the Shifting from Java implementation = to C implementation<https://syslog-ng.github.io/admin-guide/070_Destination= s/100_Kafka-c/001_Shifting_from_Java_to_C> page. * java-http - the C based http()<https://syslog-ng.github.io/admin-g= uide/070_Destinations/081_http/README> destination can be used. (#5366<https://github.com/syslog-ng/syslog-ng/pull/5366>) Credits syslog-ng is developed as a community project, and as such it relies on volunteers, to do the work necessarily to produce syslog-ng. Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute. We would like to thank the following people for their contribution: Alex Becker, Attila Szakacs, Balazs Scheidler, B=E1lint Horv=E1th, David Mandelberg, Eli Schwartz, Hofi, Kov=E1cs Gerg=F5 Ferenc, L=E1szl=F3 V=E1rady, Peter Czanik (CzP), Petr Vaganov, Shiraz, Szilard Parrag, Tamas Pal, Tam=E1s Kosztyu, shifter Peter Czanik (CzP) <[email protected]><mailto:peter.czanik@oneid= entity.com> Balabit (a OneIdentity company) / syslog-ng upstream https://syslog-ng.com/community/ https://twitter.com/PCzanik ___________________________________________________________________________= ___ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=3Dsysl= og-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq --_000_CO1PR19MB512606749CC4D4C083686EB68B3EACO1PR19MB5126namp_ Content-Type: text/html; charset="windows-1250" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dwindows-1= 250"> <style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo= ttom:0;} </style> </head> <body dir=3D"ltr"> <div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, = Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas= s=3D"elementToProof"> Hi Gyula,</div> <div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, = Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas= s=3D"elementToProof"> <br> </div> <div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, = Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas= s=3D"elementToProof"> Thanks for the report! I talked to the developer, who worked on it, and it = is not a known issue. Please open a GitHub issue at <a href=3D"https://github.com/syslog-ng/syslog-ng/issues/">https://github.c= om/syslog-ng/syslog-ng/issues/</a> for easier tracking, and also attac= h a minimal configuration to reproduce the problem, together with some info= rmation about your environment (number of log source hosts, message rate, etc.).</div> <div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, = Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas= s=3D"elementToProof"> <br> </div> <div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, = Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas= s=3D"elementToProof"> Thanks,</div> <div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, = Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas= s=3D"elementToProof"> Peter</div> <div class=3D"elementToProof" id=3D"Signature"> <div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, = Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas= s=3D"elementToProof"> <br> </div> <div class=3D"elementToProof" style=3D"direction: ltr; font-family: Calibri= , Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> Peter Czanik (CzP) <[email protected]><br> Balabit (a OneIdentity company) / syslog-ng upstream<br> <a target=3D"_blank" href=3D"https://syslog-ng.com/community/">https://sysl= og-ng.com/<wbr>community/</a><br> <a target=3D"_blank" href=3D"https://twitter.com/PCzanik">https://twitter.c= om/PCzanik</a></div> <div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size= : 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof"> <br> </div> </div> <div id=3D"appendonsend"></div> <hr style=3D"display:inline-block;width:98%" tabindex=3D"-1"> <div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st= yle=3D"font-size:11pt" color=3D"#000000"><b>From:</b> Kerekes Gyula <gyu= [email protected]><br> <b>Sent:</b> Friday, August 22, 2025 10:35<br> <b>To:</b> [email protected] <[email protected]><br= > <b>Subject:</b> [syslog-ng]Re: syslog-ng version 4.9.0 is now available</fo= nt> <div> </div> </div> <div> <div style=3D"background-color:#FFEB9C; width:100%; border-style:solid; bor= der-color:#9C6500; border-width:1pt; padding:2pt; font-size:10pt; line-heig= ht:12pt; font-family:'Calibri'; color:Black; text-align:left"> <span style=3D"color:#9C6500; font-weight:bold">CAUTION:</span> This email = originated from outside of the organization. Do not follow guidance, click = links, or open attachments unless you recognize the sender and know the con= tent is safe.</div> <br> <div> <p>Hi,<br> <br> <br> I tried this stats exporter-dont-log() feature and it works well but it see= ms like it has a mem leak somewhere. I tried to switch off the prometheus d= ata collection to one of the syslog-ng hosts and the mem consumption stayed= fairly low. On the other hand all the others used 1-2 gigs of RSS mem. Is it a known issue?<br> </p> <p><br> </p> <p>Gyula</p> <p><br> </p> <div class=3D"x_moz-cite-prefix">2025. 07. 17. 15:19 keltez=E9ssel, Peter C= zanik (pczanik) =EDrta:<br> </div> <blockquote type=3D"cite"><style type=3D"text/css" style=3D"display:none"> <!-- p {margin-top:0; margin-bottom:0} --> </style> <div class=3D"x_elementToProof" style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= ; font-size:12pt; color:rgb(0,0,0)"> Hi,</div> <div class=3D"x_elementToProof" style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= ; font-size:12pt; color:rgb(0,0,0)"> <br> </div> <div class=3D"x_elementToProof" style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= ; font-size:12pt; color:rgb(0,0,0)"> I am happy to announce that version 4.9.0 of syslog-ng is now available. Th= anks everyone who contributed code, documentation, testing, or in any other= way.</div> <div class=3D"x_elementToProof" style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= ; font-size:12pt; color:rgb(0,0,0)"> <br> </div> <div class=3D"x_elementToProof" style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= ; font-size:12pt; color:rgb(0,0,0)"> Peter</div> <div class=3D"x_elementToProof" style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= ; font-size:12pt; color:rgb(0,0,0)"> <br> </div> <div class=3D"x_elementToProof" style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= ; font-size:12pt; color:rgb(0,0,0)"> <b>4.9.0</b></div> <div class=3D"x_elementToProof" style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= ; font-size:12pt; color:rgb(0,0,0)"> <b>Highlights</b></div> <ul> <li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Aptos_M= SFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(= 0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>stats-exporter</code>: Added two new sources, <code>stats-exporter()</code> and <code>stats-exporter-dont-log()</cod= e>, which directly serve the output of <code>syslog-ng-ctl stats</code> and <code>syslog-ng-ctl query</code>&= nbsp;to a http scraper. The only difference is that <code>stats-exporter-dont-log()</code> suppresses log messages from in= coming scraper requests, ensuring no messages appear in the log path. Meanw= hile, <code>stats-exporter()</code> logs unparsed messages, storing incoming= scraper HTTP requests in the <code>MSG</code> field.</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Exam= ple usage for a Prometheus Scraper which logs the HTTP request of the scrap= er to /var/log/scraper.log:</div> <pre role=3D"presentation"><div style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= "><code>@version: 4.9 @include "scl.conf" source s_prometheus_stat { stats-exporter( ip("0.0.0.0") port(8080) stat-type("query") stat-query("*") scrape-freq-limit(30) single-instance(yes) ); }; log { source(s_prometheus_stat); destination { file(/var/log/scraper.log); }; }; </code></div></pre> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Exam= ple usage for a generic HTTP Scraper which sends e.g. the <code>GET /stats HTTP/1.1</code> HTTP request to get statistics of syslog-n= g, do not want to log or further process the HTTP requests in the log pipe,= and needs the response in CSV format:</div> <pre role=3D"presentation"><div style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= "><code>@version: 4.9 @include "scl.conf" source s_scraper_stat { stats-exporter-dont-log( ip("0.0.0.0") port(8080) stat-type("stats") stat-format("csv") scrape-pattern("GET /stats*") scrape-freq-limit(30) single-instance(yes) ); }; log { source(s_scraper_stat); }; </code></div></pre> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Note= : A destination is not required for this to work; the <code>stats-exporter()</code> source will respond to the scraper regar= dless of whether a destination is present in the log path.</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Avai= lable options:</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>stat-type(string)</code> - <code>query</code> or <code>stats</code>, just like for the <code>sysl= og-ng-ctl</code> command line tool, see there for the details<br> <code>stat-query(string)</code> - the query regex string that can be u= sed to filter the output of a <code>query</code> type request<br> <code>stat-format(string)</code> - the output format of the given stat= s request, like the <code>-m</code> option of the <code>syslog-ng-ctl</code> command = line tool<br> <code>scrape-pattern(string)</code> =96 the pattern used to match the = HTTP header of incoming scraping requests. A stat response will be generate= d and sent only if the header matches the pattern string<br> <code>scrape-freq-limit(non-negative-int)</code> - limits the frequenc= y of repeated scraper requests to the specified number of seconds. Any repe= ated request within this period will be ignored. A value of 0 means no limi= t<br> <code>single-instance(yes/no)</code> - if set to <code>yes</code> = ;only one scraper connection and request will be allowed at once<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5259/hovercard" class=3D"x_OWAAutoLink" id=3D"OWA914d3223-3ae= 6-fcea-2932-f914391330d7" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5259" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5259">#= 5259</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>syslog()</code> source driver: add support for RFC6587 style auto-de= tection of<br> octet-count based framing to avoid confusion that stems from the sender<br> using a different protocol to the server. This behaviour can be enabled<br> by using <code>transport(auto)</code> option for the <code>syslog()</c= ode> source.<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5322/hovercard" class=3D"x_OWAAutoLink" id=3D"OWAea867262-821= a-c94b-9a2a-db360bcd9f40" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5322" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5322">#= 5322</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>wildcard-file</code>: Added inotify-based regular file change detection u= sing the existing inotify-based directory monitor.</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">This= improves efficiency on OSes like Linux, where only polling was available b= efore, significantly reducing CPU usage while enhancing change detection ac= curacy.</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">To e= nable this feature, inotify kernel support is required, along with <code>monitor-method()</code> set to <code>inotify</code> or <cod= e>auto</code>, and <code>follow-freq()</code> set to 0.<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5315/hovercard" class=3D"x_OWAAutoLink" id=3D"OWAf2e3137f-1c1= d-b053-15c8-b08cece13990" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5315" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5315">#= 5315</a>)</div> </li></ul> <div class=3D"x_elementToProof" style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= ; font-size:12pt; color:rgb(0,0,0)"> <b>Features</b></div> <ul> <li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Aptos_M= SFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(= 0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>cisco</code>: Added support for Cisco Nexus NXOS 9.3 syslog format.</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">The = parser now recognises NXOS 9.3 timestamps in <code>YYYY MMM DD HH:MM:SS</code> format and handles the different<br> sequence number prefix (<code>: </code>instead of <code>seqno: </code>) use= d by NXOS 9.3 compared to traditional IOS formats.</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Exam= ple Cisco configuration:</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Exam= ple syslog-ng configuration:</div> <pre role=3D"presentation"><div style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= "><code>@include "scl.conf" source s_cisco { network(ip(0.0.0.0) transport("udp") port(2000) fla= gs(no-parse)); }; parser p_cisco { cisco-parser(); }; destination d_placeholder { # Define your destination here }; log { source(s_cisco); parser(p_cisco); destination(d_placeholder); }; </code></div></pre> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">(<a = data-hovercard-type=3D"issue" data-hovercard-url=3D"/syslog-ng/syslog-ng/is= sues/5412/hovercard" class=3D"x_OWAAutoLink" id=3D"OWAce240cde-6385-28e9-36= 03-e247f105acfb" href=3D"https://github.com/syslog-ng/syslog-ng/pull/5412" = originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5412">#5412</a>)= </div> </li><ul> <li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Aptos_M= SFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(= 0,0,0)"> NXOS: <code>(config)# logging server <syslog-ng-server-ip> port 2000<= /code></li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont",&q= uot;Aptos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt;= color:rgb(0,0,0)"> IOS: <code>(config)# logging host <syslog-ng-server-ip> transport udp= port 2000</code></li></ul> <li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Aptos_M= SFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(= 0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">bigq= uery(), google-pubsub-grpc(): Added service-account() authentication option= .</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Exam= ple usage:</div> <pre role=3D"presentation"><div style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= "><code>destination { google-pubsub-grpc( project("test") topic("test") auth(service-account(key ("path_to_service= _account_key.json"))) ); }; </code></div></pre> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Note= : In contrary to the <code>http()</code> destination's similar option,<br> we do not need to manually set the audience here as it is<br> automatically recognized by the underlying gRPC API.<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5270/hovercard" class=3D"x_OWAAutoLink" id=3D"OWA9ecdd0ae-538= 0-241a-436a-d3608224e8bd" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5270" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5270">#= 5270</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">gRPC= based destinations: Added <code>response-action()</code> option</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">With= this option, it is possible to fine tune how syslog-ng<br> behaves in case of different gRPC results.</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Supp= orted by the following destination drivers:</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Supp= orted gRPC results:</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Supp= orted actions:</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Usag= e:</div> <pre role=3D"presentation"><div style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= "><code>google-pubsub-grpc( project("my-project") topic("my-topic") response-action( not-found =3D> disconnect unavailable =3D> drop ) ); </code></div></pre> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">(<a = data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/syslo= g-ng/pull/5332/hovercard" class=3D"x_OWAAutoLink" id=3D"OWAda4d7b0b-c979-f5= bb-42fd-256728865238" href=3D"https://github.com/syslog-ng/syslog-ng/pull/5= 332" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5332">#5332= </a>)</div> </li><ul> <li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Aptos_M= SFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(= 0,0,0)"> <code>opentelemetry()</code></li><li style=3D"font-family:Aptos,"Aptos= _EmbeddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-= serif; font-size:12pt; color:rgb(0,0,0)"> <code>loki()</code></li><li style=3D"font-family:Aptos,"Aptos_Embedded= Font","Aptos_MSFontService",Calibri,Helvetica,sans-serif; fo= nt-size:12pt; color:rgb(0,0,0)"> <code>bigquery()</code></li><li style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= ; font-size:12pt; color:rgb(0,0,0)"> <code>clickhouse()</code></li><li style=3D"font-family:Aptos,"Aptos_Em= beddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-ser= if; font-size:12pt; color:rgb(0,0,0)"> <code>google-pubsub-grpc()</code></li><li style=3D"font-family:Aptos,"= Aptos_EmbeddedFont","Aptos_MSFontService",Calibri,Helvetica,= sans-serif; font-size:12pt; color:rgb(0,0,0)"> ok</li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","= Aptos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; col= or:rgb(0,0,0)"> unavailable</li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont&quo= t;,"Aptos_MSFontService",Calibri,Helvetica,sans-serif; font-size:= 12pt; color:rgb(0,0,0)"> cancelled</li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont"= ,"Aptos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12= pt; color:rgb(0,0,0)"> deadline-exceeded</li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFo= nt","Aptos_MSFontService",Calibri,Helvetica,sans-serif; font= -size:12pt; color:rgb(0,0,0)"> aborted</li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont",&= quot;Aptos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt= ; color:rgb(0,0,0)"> out-of-range</li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont&qu= ot;,"Aptos_MSFontService",Calibri,Helvetica,sans-serif; font-size= :12pt; color:rgb(0,0,0)"> data-loss</li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont"= ,"Aptos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12= pt; color:rgb(0,0,0)"> unknown</li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont",&= quot;Aptos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt= ; color:rgb(0,0,0)"> invalid-argument</li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFon= t","Aptos_MSFontService",Calibri,Helvetica,sans-serif; font-= size:12pt; color:rgb(0,0,0)"> not-found</li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont"= ,"Aptos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12= pt; color:rgb(0,0,0)"> already-exists</li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont&= quot;,"Aptos_MSFontService",Calibri,Helvetica,sans-serif; font-si= ze:12pt; color:rgb(0,0,0)"> permission-denied</li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFo= nt","Aptos_MSFontService",Calibri,Helvetica,sans-serif; font= -size:12pt; color:rgb(0,0,0)"> unauthenticated</li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont= ","Aptos_MSFontService",Calibri,Helvetica,sans-serif; font-s= ize:12pt; color:rgb(0,0,0)"> failed-precondition</li><li style=3D"font-family:Aptos,"Aptos_Embedded= Font","Aptos_MSFontService",Calibri,Helvetica,sans-serif; fo= nt-size:12pt; color:rgb(0,0,0)"> unimplemented</li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont&q= uot;,"Aptos_MSFontService",Calibri,Helvetica,sans-serif; font-siz= e:12pt; color:rgb(0,0,0)"> internal</li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont",= "Aptos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12p= t; color:rgb(0,0,0)"> resource-exhausted</li><li style=3D"font-family:Aptos,"Aptos_EmbeddedF= ont","Aptos_MSFontService",Calibri,Helvetica,sans-serif; fon= t-size:12pt; color:rgb(0,0,0)"> disconnect</li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont"= ;,"Aptos_MSFontService",Calibri,Helvetica,sans-serif; font-size:1= 2pt; color:rgb(0,0,0)"> drop</li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont",&quo= t;Aptos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; c= olor:rgb(0,0,0)"> retry</li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont",&qu= ot;Aptos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; = color:rgb(0,0,0)"> success</li></ul> <li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Aptos_M= SFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(= 0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>s3</code>: Added two new options</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Exam= ple:</div> <pre role=3D"presentation"><div style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= "><code>s3( url(<a class=3D"x_moz-txt-link-rfc2396E" href=3D"http://localhost:9000">&q= uot;http://localhost:9000"</a>) bucket("testbucket") object_key("testobject") access_key("<ACCESS_KEY_ID>") secret_key("<SECRET_ACCESS_KEY>") content_type("text/plain") use_checksum("when_required") ); </code></div></pre> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">(<a = data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/syslo= g-ng/pull/5286/hovercard" class=3D"x_OWAAutoLink" id=3D"OWA36d4dc80-2ae4-5d= b6-0688-af2fba204ff7" href=3D"https://github.com/syslog-ng/syslog-ng/pull/5= 286" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5286">#5286= </a>)</div> </li><ul> <li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Aptos_M= SFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(= 0,0,0)"> <code>content-type()</code>: users now can change the content type of the o= bjects uploaded by syslog-ng.</li><li style=3D"font-family:Aptos,"Apto= s_EmbeddedFont","Aptos_MSFontService",Calibri,Helvetica,sans= -serif; font-size:12pt; color:rgb(0,0,0)"> <code>use_checksum()</code>: This option allows the users to change the def= ault checksum settings for<br> S3 compatible solutions that don't support checksums. Requires botocore 1.3= 6 or above. Acceptable values are<br> <code>when_supported</code> (default) and <code>when_required</code>.<= /li></ul> <li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Aptos_M= SFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(= 0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>loki()</code>: Added <code>batch-bytes()</code> and <code>compression()</code> options= .<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5174/hovercard" class=3D"x_OWAAutoLink" id=3D"OWAc2aab7f1-dea= 2-9fea-a087-092c601ca57c" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5174" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5174">#= 5174</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>syslog-ng-ctl</code>: Formatting the output of the <code>syslog-ng-ctl stats</code> and <code>syslog-ng-ctl query</code>&= nbsp;commands is unified.</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Both= commands got a new <code>--format</code> (<code>-m</code>) argument that can control the = output format of the given stat or query. The following formats are support= ed:</div> </li><ul> <li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Aptos_M= SFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(= 0,0,0)"> <code>kv</code> - the legacy key-value-pairs e.g. <code>center.queued.= processed=3D0</code> (only for the <code>query</code> command yet)</li><li style=3D"font-family:Aptos,&qu= ot;Aptos_EmbeddedFont","Aptos_MSFontService",Calibri,Helveti= ca,sans-serif; font-size:12pt; color:rgb(0,0,0)"> <code>csv</code> - comma separated values e.g. <code>center;;queued;a;= processed;0</code></li><li style=3D"font-family:Aptos,"Aptos_EmbeddedF= ont","Aptos_MSFontService",Calibri,Helvetica,sans-serif; fon= t-size:12pt; color:rgb(0,0,0)"> <code>prometheus</code> - the prometheus scraper ready format e.g. <co= de>syslogng_center_processed{stat_instance=3D"queued"} 0</code><b= r> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5248/hovercard" class=3D"x_OWAAutoLink" id=3D"OWA40f2909f-74f= f-4255-2acd-5337a0d4fbcc" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5248" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5248">#= 5248</a>)</li></ul> <li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Aptos_M= SFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(= 0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>network()</code>, <code>syslog()</code> sources: add <code>$PEERIP</code> and <code= >$PEERPORT</code> macros</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">The = <code>$PEERIP</code> and <code>$PEERPORT</code> macros always display the address and port of t= he direct sender.<br> In most cases, these values are identical to <code>$SOURCEIP</code> an= d <code>$SOURCEPORT</code>.<br> However, when dealing with proxied protocols, <code>$PEERIP</code> and= <code>$PEERPORT</code> reflect the proxy's address and port,<br> while <code>$SOURCEIP</code> and <code>$SOURCEPORT</code> indicat= e the original source of the message.<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5291/hovercard" class=3D"x_OWAAutoLink" id=3D"OWAf289299f-d5e= e-1a5d-5798-3ee6cb861747" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5291" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5291">#= 5291</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>webhook()</code>,<code>opentelemetry()</code> sources: support <code>input_event_bytes</code> metrics<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5324/hovercard" class=3D"x_OWAAutoLink" id=3D"OWAc63b47c5-3ed= 2-0498-51ed-380492b9d534" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5324" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5324">#= 5324</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>freebsd-audit()</code>: added a simple source SCL to collect FreeBSD audi= t logs using the built-in praudit program</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><a r= el=3D"nofollow" class=3D"x_OWAAutoLink x_moz-txt-link-freetext" id=3D"OWAdc= b71d5a-e054-0dc7-effc-da62fe16a5fd" href=3D"https://www.syslog-ng.com/commu= nity/b/blog/posts/freebsd-audit-source-for-syslog-ng" originalsrc=3D"https:= //www.syslog-ng.com/community/b/blog/posts/freebsd-audit-source-for-syslog-= ng">https://www.syslog-ng.com/community/b/blog/posts/freebsd-audit-source-f= or-syslog-ng</a><br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5383/hovercard" class=3D"x_OWAAutoLink" id=3D"OWA08390551-c33= 8-0ea4-30a8-f4e9607cd718" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5383" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5383">#= 5383</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>webhook()</code>: headers support</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>include-request-headers(yes)</code> stores request headers under the <code>${webhook.headers}</code> key, allowing further processing</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>proxy-header("x-forwarded-for")</code> helps retain the se= nder's original IP and the proxy's IP address</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">(<co= de>$SOURCEIP</code>, <code>$PEERIP</code>).<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5333/hovercard" class=3D"x_OWAAutoLink" id=3D"OWAab2a3357-e1e= 6-304c-1f2c-4d81e00b1bc8" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5333" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5333">#= 5333</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>check-program</code>: Introduced as a flag for global or source options.<= /div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">By d= efault, this flag is set to false. Enabling the check-program flag triggers <code>program</code> name validation for <code>RFC3164</code> mes= sages. Valid <code> program</code> names must adhere to the following criteria:</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Cont= ain only these characters: <code>[a-zA-Z0-9-_/().]</code><br> Include at least one alphabetical character.<br> If a <code>program</code> name fails validation, it will be considered= part of the log message.</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Exam= ple:</div> <pre role=3D"presentation"><div style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= "><code>source { network(flags(check-hostname, check-program)); }; </code></div></pre> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">(<a = data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/syslo= g-ng/pull/5264/hovercard" class=3D"x_OWAAutoLink" id=3D"OWA91019089-851a-cc= d3-756d-c50861e356a9" href=3D"https://github.com/syslog-ng/syslog-ng/pull/5= 264" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5264">#5264= </a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>syslog(transport(proxied-*))</code> and <code>network(transport(proxied-*))</code>: changed<br> where HAProxy transport saved the original source and destination addresses= .<br> Instead of using dedicated <code>PROXIED_*</code> name-value pairs, us= e the usual<br> <code>$SOURCEIP</code>, <code>$SOURCEPORT</code>, <code>$DESTIP</code> = ;and <code> $DESTPORT</code> macros, making haproxy<br> based connections just like native ones.</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>$SOURCEPORT</code>: added new macro which expands to the source port of t= he peer.<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5305/hovercard" class=3D"x_OWAAutoLink" id=3D"OWA62b757c9-75b= c-823c-cc7c-c43c31a3023f" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5305" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5305">#= 5305</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>opentelemetry()</code>, <code>syslog-ng-otlp()</code>: Added <code>keep-alive()</code> options= .</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Keep= alive can be configured with the <code>time()</code>, <code>timeout()</code><br> and <code>max-pings-without-data()</code> options of the <code>keep-al= ive()</code> block.</div> <pre role=3D"presentation"><div style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= "><code>opentelemetry( ... keep-alive(time(20000) timeout(10000) max-pings-without-data(= 0)) ); </code></div></pre> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">(<a = data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/syslo= g-ng/pull/5174/hovercard" class=3D"x_OWAAutoLink" id=3D"OWAba20a04c-8b7e-10= aa-8396-01f29e028d65" href=3D"https://github.com/syslog-ng/syslog-ng/pull/5= 174" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5174">#5174= </a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>bigquery()</code>: Added <code>auth()</code> options.</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Simi= larly to other gRPC based destination drivers, the <code>bigquery()</code><br> destination now accepts different authentication methods, like<br> <code>adc()</code>, <code>alts()</code>, <code>insecure()</code> and <= code>tls()</code>.</div> <pre role=3D"presentation"><div style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= "><code>bigquery ( ... auth( tls( ca-file("/path/to/ca.pem&quo= t;) key-file("/path/to/key.pem&q= uot;) cert-file("/path/to/cert.pem= ") ) ) ); </code></div></pre> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">(<a = data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/syslo= g-ng/pull/5174/hovercard" class=3D"x_OWAAutoLink" id=3D"OWA51685e85-9635-4b= 10-39be-4b84ce513943" href=3D"https://github.com/syslog-ng/syslog-ng/pull/5= 174" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5174">#5174= </a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>cloud-auth</code>: Added <code>azure-monitor()</code> destination</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Adde= d oauth2 authentication for azure monitor destinations.</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Exam= ple usage:</div> <pre role=3D"presentation"><div style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= "><code>azure-monitor( dcr-id("dcr id") dce-uri("dce uri") stream_name("stream name") auth( tenant-id("tenant id") app-id("app id") app-secret("app secret") ) ) </code></div></pre> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">(<a = data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/syslo= g-ng/pull/5293/hovercard" class=3D"x_OWAAutoLink" id=3D"OWAaf98083e-64ea-b5= bc-6741-a82863e322f5" href=3D"https://github.com/syslog-ng/syslog-ng/pull/5= 293" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5293">#5293= </a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>multi-line-mode()</code>: Added a new mutiline detection mode <code>empty-line-separated</code> that, as its name suggests, reads an= d treats all messages as one till it receives an empty line (which contains= only a <code>\r</code>, <code>\n</code> or <code>\r\n</code> sequence).<= br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5259/hovercard" class=3D"x_OWAAutoLink" id=3D"OWAcc3d18fa-68e= c-49fa-b84d-3c2125b61b40" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5259" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5259">#= 5259</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>google-pubsub-grpc()</code>: Added a new destination that sends logs to G= oogle Pub/Sub via the gRPC interface.</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Exam= ple config:</div> <pre role=3D"presentation"><div style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= "><code>google-pubsub-grpc( project("my_project") topic($topic) data($MESSAGE) attributes( timestamp =3D> $S_ISODATE, host =3D> $HOST, ) workers(4) batch-timeout(1000) # ms batch-lines(1000) ); </code></div></pre> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">The = <code>project()</code> and <code>topic()</code> options are templatable.<br> The default service endpoint can be changed with the <code>service_endpoint= ()</code> option.<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5266/hovercard" class=3D"x_OWAAutoLink" id=3D"OWAc2b4646d-b50= b-023f-0f62-45485dcb937e" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5266" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5266">#= 5266</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>ivykis</code>: We have switched to <a class=3D"x_OWAAutoLink" id=3D"OWA233cb61c-47ff-a10f-f428-ccc795575d7a" h= ref=3D"https://github.com/balabit/ivykis" originalsrc=3D"https://github.com= /balabit/ivykis"> our own fork</a> of ivykis as the source for builds when using syslog-= ng=92s internal ivykis option (<code>--with-ivykis=3Dinternal</code> i= n autotools or <code>-DIVYKIS_SOURCE=3Dinternal</code> in CMake).</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">We r= ecommend switching to this internal version, as it includes new features no= t available in the <a class=3D"x_OWAAutoLink" id=3D"OWA264c2212-7150-53ca-3bd9-33fbb55fd0ce" h= ref=3D"https://github.com/buytenh/ivykis" originalsrc=3D"https://github.com= /buytenh/ivykis"> original version</a> and likely never will be.<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5307/hovercard" class=3D"x_OWAAutoLink" id=3D"OWAac3d0cb5-843= 9-1407-e710-2843e164ecdf" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5307" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5307">#= 5307</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>ivykis</code>: Fixed and merged the in development phase <code>io_uring</code> based polling method solution to <a class=3D"x_O= WAAutoLink" id=3D"OWA7755c6de-38f7-6bc3-ad4b-7727a086214b" href=3D"https://= github.com/balabit/ivykis" originalsrc=3D"https://github.com/balabit/ivykis= "> our ivykis fork</a>.</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">This= is am experimental integration and not selected by default, you must activ= ate it directly either using the <code>IV_EXCLUDE_POLL_METHOD</code> or <code>IV_SELECT_POLL_METHOD</co= de> as described <a rel=3D"nofollow" class=3D"x_OWAAutoLink" id=3D"OWA46aeffe3-c0e8-fd6a-cbc= 5-e6fc561ecb15" href=3D"https://syslog-ng.github.io/admin-guide/060_Sources= /020_File/001_File_following" originalsrc=3D"https://syslog-ng.github.io/ad= min-guide/060_Sources/020_File/001_File_following"> here</a>.<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5312/hovercard" class=3D"x_OWAAutoLink" id=3D"OWAb3c8fc2e-44d= 3-11ed-aa1e-4f07bb5a2c99" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5312" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5312">#= 5312</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>file()</code>, <code>wildcard-file()</code>: Added <code>follow-method()</code> optio= n.</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">|Acc= epted values:| legacy | inotify | poll | system |</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">This= option controls how syslog-ng will follow file changes.<br> The default <code>legacy</code> mode preserves the pre-4.9 version fil= e follow-mode behavior of syslog-ng, which is based on the value of follow-= freq().<br> The <code>poll</code> value forces syslog-ng to poll for file changes = at the interval specified by the monitor-freq() option, even if a more effi= cient method (such as <code>inotify</code> or <code>kqueue</code>) is available.<br> If <code>inotify</code> is selected and supported by the platform, sys= log-ng uses it to detect changes in source files. This is the most efficien= t and least resource-consuming option available on Linux for regular files.= <br> The <code>system</code> value will use system poll methods (via ivykis= ) like <code> port-timer</code> <code>port</code> <code>dev_poll</code> <code>epoll-timer= fd</code> <code>epoll</code> <code>kqueue</code> <code>ppoll</code> <code>poll</code>= and <code> uring</code>. For more information about how to control the system polling = methods used, see <a rel=3D"nofollow" class=3D"x_OWAAutoLink" id=3D"OWA3c099903-1e7d-eb88-5e6= f-91b6bed10048" href=3D"https://syslog-ng.github.io/admin-guide/060_Sources= /020_File/001_File_following" originalsrc=3D"https://syslog-ng.github.io/ad= min-guide/060_Sources/020_File/001_File_following"> How content changes are followed in file() and wildcard-file() sources</a>.= <br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5338/hovercard" class=3D"x_OWAAutoLink" id=3D"OWA47219dcc-99b= c-bb2d-cddd-0e4ca81eebb3" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5338" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5338">#= 5338</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>opentelemetry()</code>, <code>loki()</code> destination: Add support for templated <code>heade= r()</code> values<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5184/hovercard" class=3D"x_OWAAutoLink" id=3D"OWA4491306e-22c= 5-b29c-3b9f-61b6cfaf15e7" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5184" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5184">#= 5184</a>)</div> </li></ul> <div class=3D"x_elementToProof" style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= ; font-size:12pt; color:rgb(0,0,0)"> <b>Bugfixes</b></div> <ul> <li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Aptos_M= SFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(= 0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>syslog-ng-otlp()</code> destination: Fixed a crash.<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5267/hovercard" class=3D"x_OWAAutoLink" id=3D"OWA8fefd32d-3ea= e-69f0-ffe2-8eba681d665c" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5267" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5267">#= 5267</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">Fixe= d some time parsing and time formatting issues.<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5386/hovercard" class=3D"x_OWAAutoLink" id=3D"OWA2af8b2bd-989= 9-0140-a563-435a9ba1c972" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5386" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5386">#= 5386</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">sysl= ogformat: Fix integer overflow on set pri<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5254/hovercard" class=3D"x_OWAAutoLink" id=3D"OWA8d785fe1-475= 1-c148-a0c1-04d60dd359b9" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5254" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5254">#= 5254</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>network(), syslog()</code>: Fixed a potential crash for TLS destinations = during reload</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">In c= ase of a TLS connection, if the handshake didn't happen before reloading sy= slog-ng,<br> it crashed on the first message sent to that destination.<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5303/hovercard" class=3D"x_OWAAutoLink" id=3D"OWAe25c2ec5-674= 0-7a80-26c6-9454aaf6b84d" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5303" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5303">#= 5303</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>collectd()</code>: fix not reading server responses<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5390/hovercard" class=3D"x_OWAAutoLink" id=3D"OWA1105d838-4c1= 5-e46c-bdd0-77c7c7507b9b" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5390" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5390">#= 5390</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">metr= ics: <code> syslog-ng-ctl --reset</code> will no longer reset Prometheus metrics<b= r> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5261/hovercard" class=3D"x_OWAAutoLink" id=3D"OWA83cbd238-826= 2-04c6-7d39-5189ba255e56" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5261" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5261">#= 5261</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>rate-limit()</code>: fix precision issue that could occur at a very low m= essage rate<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5346/hovercard" class=3D"x_OWAAutoLink" id=3D"OWA92506a95-2e8= 3-67e7-75f2-2e23c08bcb1b" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5346" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5346">#= 5346</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>network()</code>, <code>syslog()</code> sources and destinations: fix TCP/TLS shutdown<b= r> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5271/hovercard" class=3D"x_OWAAutoLink" id=3D"OWA6ba6f48d-60a= f-16f9-ce38-2e53693822a9" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5271" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5271">#= 5271</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>http</code>: Fixed a batching related bug that happened with templated UR= Ls and a single worker.<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5281/hovercard" class=3D"x_OWAAutoLink" id=3D"OWAc0e8fefe-e27= d-3da5-7dc2-51ad3a13e6dc" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5281" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5281">#= 5281</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em"><cod= e>network()</code>, <code>syslog()</code> destinations: handle async TLS messages (KeyUpda= te, etc.)<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5390/hovercard" class=3D"x_OWAAutoLink" id=3D"OWAa3ac4307-be7= 8-9f95-5a76-215786dceea8" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5390" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5390">#= 5390</a>)</div> </li></ul> <div class=3D"x_elementToProof" style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= ; font-size:12pt; color:rgb(0,0,0)"> <b>Notes to developers</b></div> <ul> <li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Aptos_M= SFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(= 0,0,0)"> editorconfig: configure supported editors for the project's style<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5331/hovercard" class=3D"x_OWAAutoLink" id=3D"OWA9f0200a4-f99= 3-a914-a057-8613ce61c2f4" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5331" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5331">#= 5331</a>)</li></ul> <div class=3D"x_elementToProof" style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= ; font-size:12pt; color:rgb(0,0,0)"> <b>Other changes</b></div> <ul> <li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Aptos_M= SFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(= 0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">java= -modules: Upgrade java <code>common</code> and <code>hdfs</code> dependencies.<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5366/hovercard" class=3D"x_OWAAutoLink" id=3D"OWAcd69fd17-3f4= 8-b8ef-bc12-5778fecd3f06" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5366" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5366">#= 5366</a>)</div> </li><li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Ap= tos_MSFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color= :rgb(0,0,0)"> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">java= -modules: Remove depricated java destinations: <code>elasticsearch2</code>, <code>kafka-java</code> and the <code>jav= a-http</code>.</div> <div role=3D"presentation" style=3D"margin-top:1em; margin-bottom:1em">The = following destinations can be used instead:</div> </li><ul> <li style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Aptos_M= SFontService",Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(= 0,0,0)"> <code>elasticsearch2</code> - Both <a rel=3D"nofollow" class=3D"x_OWAA= utoLink" id=3D"OWA55162fde-0d2c-2281-4aea-59918504f674" href=3D"https://sys= log-ng.github.io/admin-guide/070_Destinations/035_elasticsearch-datastream/= README" originalsrc=3D"https://syslog-ng.github.io/admin-guide/070_Destinat= ions/035_elasticsearch-datastream/README"> elastic-datastream()</a> or the <a rel=3D"nofollow" class=3D"x_OWAAuto= Link" id=3D"OWAc3d2fc4c-a269-a5c8-9f44-4f032b192f07" href=3D"https://syslog= -ng.github.io/admin-guide/070_Destinations/030_Elasticsearch-http/README" o= riginalsrc=3D"https://syslog-ng.github.io/admin-guide/070_Destinations/030_= Elasticsearch-http/README"> elastic-http()</a> can be used.</li><li style=3D"font-family:Aptos,&qu= ot;Aptos_EmbeddedFont","Aptos_MSFontService",Calibri,Helveti= ca,sans-serif; font-size:12pt; color:rgb(0,0,0)"> <code>kafka-java</code> - The C based <a rel=3D"nofollow" class=3D"x_O= WAAutoLink" id=3D"OWAb563cc7a-8d37-8589-73e0-65ae2d9dec46" href=3D"https://= syslog-ng.github.io/admin-guide/070_Destinations/100_Kafka-c/README" origin= alsrc=3D"https://syslog-ng.github.io/admin-guide/070_Destinations/100_Kafka= -c/README"> kafka-c()</a> destination can be used instead. To help with migration = check out the <a rel=3D"nofollow" class=3D"x_OWAAutoLink" id=3D"OWA74dd0b3c-1e2e-922c-aa1= a-487a8c7ef353" href=3D"https://syslog-ng.github.io/admin-guide/070_Destina= tions/100_Kafka-c/001_Shifting_from_Java_to_C" originalsrc=3D"https://syslo= g-ng.github.io/admin-guide/070_Destinations/100_Kafka-c/001_Shifting_from_J= ava_to_C"> Shifting from Java implementation to C implementation</a> page.</li><l= i style=3D"font-family:Aptos,"Aptos_EmbeddedFont","Aptos_MSF= ontService",Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,= 0,0)"> <code>java-http</code> - the C based <a rel=3D"nofollow" class=3D"x_OW= AAutoLink" id=3D"OWAd8cafee0-14ab-303c-81f1-1d0b5a7c0128" href=3D"https://s= yslog-ng.github.io/admin-guide/070_Destinations/081_http/README" originalsr= c=3D"https://syslog-ng.github.io/admin-guide/070_Destinations/081_http/READ= ME"> http()</a> destination can be used.<br> (<a data-hovercard-type=3D"pull_request" data-hovercard-url=3D"/syslog-ng/s= yslog-ng/pull/5366/hovercard" class=3D"x_OWAAutoLink" id=3D"OWAb261075a-781= e-6fd0-9215-4e3a40933aba" href=3D"https://github.com/syslog-ng/syslog-ng/pu= ll/5366" originalsrc=3D"https://github.com/syslog-ng/syslog-ng/pull/5366">#= 5366</a>)</li></ul> </ul> <div class=3D"x_elementToProof" style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= ; font-size:12pt; color:rgb(0,0,0)"> <b>Credits</b></div> <div class=3D"x_elementToProof" style=3D"margin-top:1em; margin-bottom:1em;= font-family:Aptos,"Aptos_EmbeddedFont","Aptos_MSFontService= ",Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)"> syslog-ng is developed as a community project, and as such it relies<br> on volunteers, to do the work necessarily to produce syslog-ng.</div> <div class=3D"x_elementToProof" style=3D"margin-top:1em; margin-bottom:1em;= font-family:Aptos,"Aptos_EmbeddedFont","Aptos_MSFontService= ",Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)"> Reporting bugs, testing changes, writing code or simply providing<br> feedback are all important contributions, so please if you are a user<br> of syslog-ng, contribute.</div> <div class=3D"x_elementToProof" style=3D"margin-top:1em; margin-bottom:1em;= font-family:Aptos,"Aptos_EmbeddedFont","Aptos_MSFontService= ",Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)"> We would like to thank the following people for their contribution:</div> <div class=3D"x_elementToProof" style=3D"margin-top:1em; margin-bottom:1em;= font-family:Aptos,"Aptos_EmbeddedFont","Aptos_MSFontService= ",Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)"> Alex Becker, Attila Szakacs, Balazs Scheidler, B=E1lint Horv=E1th,<br> David Mandelberg, Eli Schwartz, Hofi, Kov=E1cs Gerg=F5 Ferenc,<br> L=E1szl=F3 V=E1rady, Peter Czanik (CzP), Petr Vaganov,<br> Shiraz, Szilard Parrag, Tamas Pal, Tam=E1s Kosztyu, shifter</div> <div class=3D"x_elementToProof" style=3D"font-family:Aptos,"Aptos_Embe= ddedFont","Aptos_MSFontService",Calibri,Helvetica,sans-serif= ; font-size:12pt; color:rgb(0,0,0)"> <br> </div> <div class=3D"x_elementToProof" id=3D"x_Signature"> <div class=3D"x_elementToProof" style=3D"font-family:Aptos,Aptos_EmbeddedFo= nt,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:= rgb(0,0,0)"> <br> </div> <div class=3D"x_elementToProof" style=3D"direction:ltr; font-family:Calibri= ,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)"> Peter Czanik (CzP) <a class=3D"x_moz-txt-link-rfc2396E" href=3D"mailto:pete= [email protected]"> <[email protected]></a><br> Balabit (a OneIdentity company) / syslog-ng upstream<br> <a target=3D"_blank" href=3D"https://syslog-ng.com/community/" originalsrc= =3D"https://syslog-ng.com/community/">https://syslog-ng.com/<wbr>community/= </a><br> <a target=3D"_blank" href=3D"https://twitter.com/PCzanik" originalsrc=3D"ht= tps://twitter.com/PCzanik" class=3D"x_moz-txt-link-freetext">https://twitte= r.com/PCzanik</a></div> <div class=3D"x_elementToProof" style=3D"font-family:Calibri,Arial,Helvetic= a,sans-serif; font-size:12pt; color:rgb(0,0,0)"> <br> </div> </div> <br> <fieldset class=3D"x_moz-mime-attachment-header"></fieldset> <pre class=3D"x_moz-quote-pre">____________________________________________= __________________________________ Member info: <a class=3D"x_moz-txt-link-freetext" href=3D"https://lists.bal= abit.hu/mailman/listinfo/syslog-ng" originalsrc=3D"https://lists.balabit.hu= /mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/sysl= og-ng</a> Documentation: <a class=3D"x_moz-txt-link-freetext" href=3D"http://www.bala= bit.com/support/documentation/?product=3Dsyslog-ng" originalsrc=3D"http://w= ww.balabit.com/support/documentation/?product=3Dsyslog-ng">http://www.balab= it.com/support/documentation/?product=3Dsyslog-ng</a> FAQ: <a class=3D"x_moz-txt-link-freetext" href=3D"http://www.balabit.com/wi= ki/syslog-ng-faq" originalsrc=3D"http://www.balabit.com/wiki/syslog-ng-faq"= >http://www.balabit.com/wiki/syslog-ng-faq</a> </pre> </blockquote> </div> </div> </body> </html> --_000_CO1PR19MB512606749CC4D4C083686EB68B3EACO1PR19MB5126namp_-- --===============6217140853942008318== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ______________________________________________________________________________ Member info: %(web_page_url)slistinfo/%(_internal_name)s Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq --===============6217140853942008318==--