This is the fifth bug-fix release for the 3.5.x series. Starting with this release, the 3.5 branch replaces 3.4 as the current "stable" version. Upgrading from earlier versions - and especially earlier branches - is highly recommended.

New features

• The facility() filter now supports ranges, allowing one to capture a range of facilities: facility(local0..local6).
• The $(format-json) template function now supports SEQNUM.
• The upstart script in contrib has been improved to allow the user to override certain settings (such as the configuration file, and the pidfile), and allow extra options to be specified.

Bugfixes

• Major memory leaks have been fixed in various parts of syslog-ng, including but not limited to network and file destinations and sources, value-pairs (thus affecting mongodb, $(format-json), and others), template handling and rewrite rules.

  Some of these leaks only happened during reload, some leaked on every message. They have now been plugged.

• The value-pairs framework has seen a lot of updates, too:

  • It now honors time zone settings, so everything that uses value-pairs, will correctly take time zone settings into account.
  • Using globs in the key() option of value pairs will now also search macros for matches (thus key("D*") will match DATE too).
  • The syslog-proto (RFC5424) scope now correctly includes SDATA.
  • A bug that resulted in hierarchical elements being misparsed and made to appear in random places have been fixed.

• The body() and subject() options of the SMTP destinations are now mandatory, and a double-free was also fixed in the driver.

• Minor fixes were made to the $(env) template function, so that when looking up an empty environment variable, we will no longer trigger a glib warning. A misleading error message was also corrected.

• The pdbtool patternize tool will now output version 4 PDB XML.

• The configure script will not try to configure the AMQP module if no suitable version of python is installed. This avoids a difficult to diagnose error message during compilation.

Developer news

• When compiled with internal ivykis, we will now install its headers too, along with our own. This is to make it easier for the Incubator to be compiled against a syslog-ng with embedded ivykis.
• Plugin symbols are now loaded differently, in a way that lets plugins load further plugins, and use already loaded symbols. This is required for the various scripting destinations in the Incubator.
• Starting with this release, we are installing the testing helpers as a convenience library (available under the syslog-ng-test pkg-config module). This allows third party projects to use our helpers.

Credits

syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng.

Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute.

These people have helped in this release:

Balazs Scheidler
Daniel Gados
Fabien Wernli
Gergely Nagy
Laszlo Budai
Laszlo Meszaros
Nick Alcock
Peter Czanik
Peter Gyongyosi
Sebastien Badia
Tibor Benke
Viktor Juhasz
Viktor Tusa
Xufeng Zhang
Zoltan Pallagi

syslog-ng 3.4.8

This is the seventh bug-fix release for the 3.4.x series, with a set of important fixes over 3.4.7 released last December. Upgrading to this release is highly recommended.

Features

• Support for tzif3 format timezone files (used by recent releases of the tzdata package) was implemented.
• SDATA enterprise IDs are now handled correctly when using value-pairs, they will not be needlessly split up into smaller chunks.

Bugfixes

• Drivers using value-pairs() (mongodb, format-json, etc) were made more robust, and will not behave strangely anymore when using higher compiler optimisation levels.
• The DATE macro in most value-pairs() scopes will now always contain the stamp time, as opposed to sometimes the received or the stamp time.
• The syslog-proto (rfc5424) scope of value-pairs() now includes SDATA too.
• The $SEQNUM macro is now correctly handled by the $(format-json) template function.
• Drivers using value-pairs() will now work correctly when a macro is specified in a key() statement.
• When using the same json-parser() in multiple log paths, syslog-ng no longer crashes when no marker was set.
• When a GeoIP lookup fails, handle it gracefully, avoiding an annoying glib warning.
• When running in a FreeBSD jail, the system() source will not use /dev/klog.
• Various memory leaks were plugged (related to internal locking, and value-pairs).
• When building from Git, the grammar files are now build-able with bison 3+. Builds from tarballs are unaffected.

Miscellaneous changes

• The host() and port() options of the MongoDB destination driver have been labelled as deprecated. They already were, just not marked so.
• The username() and password() options of the AMQP driver were made mandatory.

Credits

syslog-ng is developed as a community project, and as such it relies on volunteers to do the work necessarily to produce syslog-ng.

Reporting bugs, testing changes, writing code or simply providing feedback are all important contributions, so please if you are a user of syslog-ng, contribute.

These people have helped in this release:

Andras Mitzki
Balazs Scheidler
Daniel Gados
Fabien Wernli
Gergely Nagy
Igor Ippolitov
Laszlo Meszaros
Nick Alcock
Peter Czanik
Tibor Benke
Viktor Tusa
Xufeng Zhang