From rgerhards at hq.adiscon.com Tue Feb 12 12:53:35 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Tue, 12 Feb 2008 12:53:35 +0100 Subject: [rsyslog] rsyslog 2.0.2 released Message-ID: <577465F99B41C842AAFBE9ED71E70ABA3088E6@grfint2.intern.adiscon.com> Hi all, rsyslog 2.0.2, a stable branch version, has been released today. It is a purely bug-fixing release, providing even better stability. It is a recommended update for all stable branch users. Change Log: http://www.rsyslog.com/Article171.phtml Download: http://www.rsyslog.com/Downloads-req-getit-lid-77.phtml I hope this release is useful. Rainer Gerhards From rgerhards at hq.adiscon.com Tue Feb 12 18:23:13 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Tue, 12 Feb 2008 18:23:13 +0100 Subject: [rsyslog] rsyslog 3.11.1 released Message-ID: <577465F99B41C842AAFBE9ED71E70ABA3088EA@grfint2.intern.adiscon.com> Hi all, the development branch also sees a new release today: 3.11.1 has just been released. The main new feature is a SNMP trap sender which enables syslog messages to be sent via SNMP traps. Otherwise, 3.11.1 is a stability update with a number of important bug fixes and documentation enhancements. For plugin-writers, there now is a copy-template for input plugins available. Version 3.11.1 is a recommended update for all v3 users. Change Log: http://www.rsyslog.com/Article173.phtml Download: http://www.rsyslog.com/Downloads-req-getit-lid-78.phtml As always, feedback is appreciated. Best regards, Rainer Gerhards From rgerhards at hq.adiscon.com Wed Feb 13 18:04:37 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Wed, 13 Feb 2008 18:04:37 +0100 Subject: [rsyslog] text file input plugin Message-ID: <577465F99B41C842AAFBE9ED71E70ABA30890A@grfint2.intern.adiscon.com> Hi all, a first version of the text file input plugin is available as a preview. Please find details at: http://www.rsyslog.com/PNphpBB2-viewtopic-t-188.phtml Thanks, Rainer From rgerhards at hq.adiscon.com Thu Feb 14 11:11:26 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Thu, 14 Feb 2008 11:11:26 +0100 Subject: [rsyslog] New File Monitor Preview Message-ID: <1202983886.27512.16.camel@localhost.localdomain> I just posted a new, enhanced preview: http://download.rsyslog.com/rsyslog/rsyslog-3.11.2-pre.tar.gz md5sum: d7b7d20d6a67fc03872edd42684f0468 Feedback is appreciated, Rainer From rgerhards at hq.adiscon.com Thu Feb 14 14:45:16 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Thu, 14 Feb 2008 14:45:16 +0100 Subject: [rsyslog] Web Interface for rsyslog Message-ID: <577465F99B41C842AAFBE9ED71E70ABA30891E@grfint2.intern.adiscon.com> Hi all, I just wanted to make you aware that we now have seriously begun to work on phpLogCon v2, the new web interface for rsyslog. It's currently in the design phase and thus it is a very good time for suggestions, feature requests, and, and, and... Current discussion can be found here: http://www.phplogcon.org/PNphpBB2-viewforum-f-6.phtml As you probably know, I wasn't very happy with phpLogCon v1 the past months. It also received very low attention and consequently could not take off. We have decided the change that dramatically. You'll see a much enhanced, hopefully very useful interface. Of course, it will take some time. I hope to have a very rough, but useful, first version available some time in March. I personally will only be involved in the design of the web app, not its actual implementation. We appreciate feedback very much. Thanks, Rainer From mbiebl at gmail.com Thu Feb 14 15:10:48 2008 From: mbiebl at gmail.com (Michael Biebl) Date: Thu, 14 Feb 2008 15:10:48 +0100 Subject: [rsyslog] New File Monitor Preview In-Reply-To: <1202983886.27512.16.camel@localhost.localdomain> References: <1202983886.27512.16.camel@localhost.localdomain> Message-ID: 2008/2/14, Rainer Gerhards : > I just posted a new, enhanced preview: > > http://download.rsyslog.com/rsyslog/rsyslog-3.11.2-pre.tar.gz > md5sum: d7b7d20d6a67fc03872edd42684f0468 Wouldn't it be a good idea to use inotify (on linux) instead of polling? With all the recent efforts to reduce wakeups (see powertop), a polling syslogd would be counterproductive. Cheers, Michael -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth? From rgerhards at hq.adiscon.com Thu Feb 14 15:15:37 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Thu, 14 Feb 2008 15:15:37 +0100 Subject: [rsyslog] New File Monitor Preview In-Reply-To: References: <1202983886.27512.16.camel@localhost.localdomain> Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308922@grfint2.intern.adiscon.com> Michael, agreed, but I'll move it to feature request status. I'd like to have a basic imfile ready and then extend it. That one would also work on all platforms (with and without inotify). Let it mature a bit in practice. Then add (via ./configure flag?) the ability to use inotify. If you agree, I'd add a tracker item so that this is not forgetten. Rainer > -----Original Message----- > From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog- > bounces at lists.adiscon.com] On Behalf Of Michael Biebl > Sent: Thursday, February 14, 2008 3:11 PM > To: rsyslog-users > Subject: Re: [rsyslog] New File Monitor Preview > > 2008/2/14, Rainer Gerhards : > > I just posted a new, enhanced preview: > > > > http://download.rsyslog.com/rsyslog/rsyslog-3.11.2-pre.tar.gz > > md5sum: d7b7d20d6a67fc03872edd42684f0468 > > Wouldn't it be a good idea to use inotify (on linux) instead of > polling? > With all the recent efforts to reduce wakeups (see powertop), a > polling syslogd would be counterproductive. > > Cheers, > Michael > > -- > Why is it that all of the instruments seeking intelligent life in the > universe are pointed away from Earth? > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog From rgerhards at hq.adiscon.com Fri Feb 15 16:05:35 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Fri, 15 Feb 2008 16:05:35 +0100 Subject: [rsyslog] rsyslog 3.11.2 released Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308956@grfint2.intern.adiscon.com> Hi all, Rsyslog 3.11.2 has just been released. Now it has the ability to convert text files into syslog. This is done by the imfile plugin, which monitors text files. A new libdbi-based output plugin has been written. This adds six additional databases (including Firebird and Oracle) to the supported database set. Also contains small bug fixes. Version 3.11.2 is a recommended release for all version 3 users. Doc for new Modules: http://www.rsyslog.com/doc-omlibdbi.html http://www.rsyslog.com/doc-imfile.html Changelog: http://www.rsyslog.com/Article175.phtml Download: http://www.rsyslog.com/Downloads-req-getit-lid-79.phtml I hope this release is useful. As always, feedback is appreciated. Best regards, Rainer Gerhards From friedl at hq.adiscon.com Mon Feb 18 12:48:08 2008 From: friedl at hq.adiscon.com (Florian Riedl) Date: Mon, 18 Feb 2008 12:48:08 +0100 Subject: [rsyslog] rsyslog 3.11.3 released In-Reply-To: <577465F99B41C842AAFBE9ED71E70ABA308997@grfint2.intern.adiscon.com> References: <577465F99B41C842AAFBE9ED71E70ABA308997@grfint2.intern.adiscon.com> Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308998@grfint2.intern.adiscon.com> Hi all, Rsyslog 3.11.3 has been released today. It is a bug-fixing release. The most important fix is correction of the kernel log format. It had duplicated fields, which made it quite ugly and also could cause confusion to both humans and scripts. Other than that, there are also a few minor doc fixes and some stability updates. Version 3.11.3 is a recommended update for all v3 branch users. Changelog: http://www.rsyslog.com/Article177.phtml Download: http://www.rsyslog.com/Downloads-req-getit-lid-80.phtml As always, feedback is appreciated. Florian Riedl From santoshks at TechMahindra.com Mon Feb 18 15:10:46 2008 From: santoshks at TechMahindra.com (Santoshkumar K S) Date: Mon, 18 Feb 2008 19:40:46 +0530 Subject: [rsyslog] Doubt in syslog. Message-ID: <089781E831473740B23334AE52636CD30D417802@SINBNGEX001.TechMahindra.com> Hi, I have a doubt about a syslog file. In our system, all the client syslogs are forwarded to single syslog server. The timestamp found in syslog in syslog server is whether a client timestamp or the server timestamp.....? Can u please answer this question...? Thanks, Santhosh Kumar.K.S. ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at http://www.techmahindra.com/Disclaimer.html externally and http://tim.techmahindra.com/Disclaimer.html internally within Tech Mahindra. ============================================================================================================================ From rgerhards at hq.adiscon.com Mon Feb 18 15:33:46 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Mon, 18 Feb 2008 15:33:46 +0100 Subject: [rsyslog] Doubt in syslog. In-Reply-To: <089781E831473740B23334AE52636CD30D417802@SINBNGEX001.TechMahindra.com> References: <089781E831473740B23334AE52636CD30D417802@SINBNGEX001.TechMahindra.com> Message-ID: <577465F99B41C842AAFBE9ED71E70ABA3089A5@grfint2.intern.adiscon.com> There are actually two timestamps. "timereported" is taken from the message, but it requires that the sender included a timestamp (not all do). "timegenerated" is the time the message was received. The default templates use "timereported", as far as I remember. If it's important and you are in doubt, simply define your own template, so you know what you use ;) Properties are described here: http://www.rsyslog.com/doc-property_replacer.html The rest is in the config guide (links at the bottom). Rainer > -----Original Message----- > From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog- > bounces at lists.adiscon.com] On Behalf Of Santoshkumar K S > Sent: Monday, February 18, 2008 3:11 PM > To: rsyslog at lists.adiscon.com > Subject: [rsyslog] Doubt in syslog. > > > Hi, > > I have a doubt about a syslog file. > > In our system, all the client syslogs are forwarded to > single > syslog server. > > The timestamp found in syslog in syslog server is whether a > client timestamp or the server timestamp.....? > > Can u please answer this question...? > > > > Thanks, > > Santhosh Kumar.K.S. > > > > ======================================================================= > ===================================================== > > Disclaimer: > > This message and the information contained herein is proprietary and > confidential and subject to the Tech Mahindra policy statement, you may > review the policy at href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahin > dra.com/Disclaimer.html externally and href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahin > dra.com/Disclaimer.html internally within Tech Mahindra. > > ======================================================================= > ===================================================== > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog From mbiebl at gmail.com Mon Feb 18 15:38:48 2008 From: mbiebl at gmail.com (Michael Biebl) Date: Mon, 18 Feb 2008 15:38:48 +0100 Subject: [rsyslog] Doubt in syslog. In-Reply-To: <577465F99B41C842AAFBE9ED71E70ABA3089A5@grfint2.intern.adiscon.com> References: <089781E831473740B23334AE52636CD30D417802@SINBNGEX001.TechMahindra.com> <577465F99B41C842AAFBE9ED71E70ABA3089A5@grfint2.intern.adiscon.com> Message-ID: 2008/2/18, Rainer Gerhards : > > > > Disclaimer: > > > > This message and the information contained herein is proprietary and > > confidential and subject to the Tech Mahindra policy statement, you > may > > review the policy at References: <089781E831473740B23334AE52636CD30D417802@SINBNGEX001.TechMahindra.com><577465F99B41C842AAFBE9ED71E70ABA3089A5@grfint2.intern.adiscon.com> Message-ID: <577465F99B41C842AAFBE9ED71E70ABA3089A8@grfint2.intern.adiscon.com> Lol... not just me - www.mail-archive.com and a few other of these folks, too ;) This reminds me that I should add a "post at your own risk and if you do all your content is owned by us" reminder to the mailing list ;) Rainer > -----Original Message----- > From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog- > bounces at lists.adiscon.com] On Behalf Of Michael Biebl > Sent: Monday, February 18, 2008 3:39 PM > To: rsyslog-users > Subject: Re: [rsyslog] Doubt in syslog. > > 2008/2/18, Rainer Gerhards : > > > > > > Disclaimer: > > > > > > This message and the information contained herein is proprietary > and > > > confidential and subject to the Tech Mahindra policy statement, you > > may > > > review the policy at > Wow, nice disclaimer. > You are in trouble now, Rainer ;-) > > Michael > > -- > Why is it that all of the instruments seeking intelligent life in the > universe are pointed away from Earth? > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog From rgerhards at hq.adiscon.com Tue Feb 19 09:15:10 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Tue, 19 Feb 2008 09:15:10 +0100 Subject: [rsyslog] Huwai junk patent predating on syslog and BEEP now online Message-ID: <577465F99B41C842AAFBE9ED71E70ABA3089B4@grfint2.intern.adiscon.com> Hi all, I have just been able to find the one of the uttermost pieces of carp that the wrotten patent system has produced. May I introduce you to Miao's genius invention for the syslog protocol: http://www.freepatentsonline.com/EP1881668.html As a side-note, it has quite some technical flaws and shows some fundamental misunderstanding on how syslog works. But maybe that's what the real invention is... I also find it quite disturbing how the tuning profile selection process from RFC 3080 is being re-invented in this invention. And it is also a nice steal to see my architecture slides http://www.syslog.cc/ietf/presentat/syslog-protocol-03/img3.html being represented in a childish way (or did you steal them from a freshmen's course book?). Thanks Huwaii and Miao for this great invention and stealing my work. I really appreciate it. I bet Marshall T. Rose will also be delighted. Rainer From rgerhards at hq.adiscon.com Wed Feb 20 08:20:45 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Wed, 20 Feb 2008 08:20:45 +0100 Subject: [rsyslog] Feedback Requested: Dual-Licensing rsyslog Message-ID: <577465F99B41C842AAFBE9ED71E70ABA3089C6@grfint2.intern.adiscon.com> Hi all, I have had a couple of discussions with a lot of folks in the past days. During them, an idea was born that I would now like to present to the broader audience here on the list: We consider dual-licensing rsyslog, just like e.g. MySQL is dual licensed. Nothing is yet finalized and I honestly request feedback on that idea. Please let me explain... What would it mean? For open source users, nothing at all changes. Rsyslog would still be licensed under GPL. However, the proposal would give us the option to release certain parts under GPLv2 (remember rsyslog v3 and above are licensed under GPLv3). While we did not yet consider this option, it has been brought to our attention that libmysqlclient is licensed GPLv2 only and as such cannot be linked to a GPLv3 program (the ommysql plugin). I currently try to sort this out and have contacted MySQL, but unfortunately did not yet receive a reply. Should that become a real issue, we can either drop MySQL support or we can move the affected part to GPLv2. Thanks to the plugin architecture, the main executable is not affected, so it would be a matter of changing the license on the MySQL plugin (which is in all respects a separate project just combined in the main tarball for convenience - long term users know that it once was a separate project ... and very inconvenient to handle ;)). When it comes to commercial applications, there *is* a change. Dual-licensing would enable us to provide rsyslog technology under a commercial license and thus add to the funding of the project. The most important use case for this ability is probably Adiscon itself. Remember: Adiscon sponsors rsyslog development. Actually, the funding is currently almost exclusively provided by Adiscon's commercial software sales in the Windows environment. Rsyslog has much evolved and its object model is becoming more and more appealing in itself. I now have been granted permission to include Adiscon's proprietary BEEP stack (based on, but superior to liblogging) into rsyslog. This would free the formerly closed source and make it available to the open source community at large (under GPLv3). However, permission is granted only under the condition that code improvements (and there will be a lot) can be contributed back to Adiscon's commercial software. One way to do that would be, of course, to create a separate project for these sources and dual-license that from the beginning on. However, that sounds unnatural and overly complicated to me. I would like to concentrate on writing the greatest syslog technology on earth and not on circumventing license restrictions... Than I was told that a number of open source project successfully use dual licensing and this is probably the best route to take. What would it NOT mean? Dual licensing rsyslog is NOT intended as a step to build different editions of rsyslog, where some of them will become closed source and only be available for a fee. It is both my and Adiscon's firm believe that such a movement is plainly wrong and severely impacts an open source project. This will not happen to rsyslog. The intension of dual licensing it is to use (parts of) its technology in commercial context's, not to make rsyslog in itself a product. So, why bother? If nothing really changes for the user base, why am I writing this long mail? Well, first of all I would like to avoid everything that badly affects the rsyslog project. So I ask for feedback if you see any problems with this move. Secondly, and more importantly, code contributors *are* affected. This is another reason why I post on this list, where I reach almost all contributors. In order to dual license a work, one must be copyright holder of the whole work. Thankfully, I have written most parts of the technology that are interesting for dual licensing. However, there were a number of much appreciated contributions (once again a big thank you to all who contribute!). Even though there was no explicit license applied to any of the contributions, I think it is a fair to assume they were meant to be licensed under the same license rsyslog is. So we in fact have multiple copyright holders. In support for dual licensing, we would need to set up a policy that patch authors transfer their copyright to Adiscon and me. I believe that a contribution policy is well enough to do the trick. Specifically, I am a strong opponent of any copyright transfer documents that need to be signed before I can integrate a patch. Instead, I would setup a contribution policy page that states that copyright is automatically been transferred by sending in a patch. If I can't get away without it, I may send a link to this page after I received a patch, but that would all that happened. And, of course, we need to have permission from past contributors to use their patches under this model - so if you have contributed and don't like the policy, please reply so that I know it. Feedback, please... I honestly think that the ability to dual-license rsyslog brings benefit to the long-term goals of rsyslog. Seeing other (big) open source projects like MySQL using such a policy and succeeding in the community makes me feel good about it. But, again, I would not like to cause any troubles to the rsyslog project. So please reply if you don't like the thoughts outlined here or if you have any concerns. Nothing is fixed yet, but I'd like to get over it as soon as possible... Please reply by private mail if you'd like not to express yourself on the list. Thanks a lot, Rainer From mbiebl at gmail.com Wed Feb 20 17:37:18 2008 From: mbiebl at gmail.com (Michael Biebl) Date: Wed, 20 Feb 2008 17:37:18 +0100 Subject: [rsyslog] Feedback Requested: Dual-Licensing rsyslog In-Reply-To: <577465F99B41C842AAFBE9ED71E70ABA3089C6@grfint2.intern.adiscon.com> References: <577465F99B41C842AAFBE9ED71E70ABA3089C6@grfint2.intern.adiscon.com> Message-ID: 2008/2/20, Rainer Gerhards : > Hi all, > > Feedback, please... Tbh, I have mixed feelings about that. First of all, I have to say, that I'm not a lawyer, do don't take my words for granted. But as the original source code is licensed under the GPL (at least parts of it like klogd and pidfile.c), and is copyright of the original authors, you can't just relicense it. You'd have to ask the original authors for permission. Second, I don't think that simply providing a wiki page, stating that for all contributions the copyright is automatically transferred to adiscon is legally effective. You definitely have to ask a lawyer for clarification here. For dual-licensed projects I know, like e.g. Qt, I know that they don't/can't accept contributions (afaik even simple bug fixes) without such a waiver. That's a major pain. As a result (at least from my experience), many people avoid to contribute to such dual-licensed projects. If you take Qt or MySQL again, you'll see that they are almost 100% developed by the company itself. The flow of external contributions is very little. If you remember the latest discussion on the debian-devel mailing list, you will remember that the current license of rsyslog was mentioned as a definite advantage over syslog-ng. Imho the acceptance and the participation in the community will be higher if rsyslog stayed a gpl only project. Again, this is only my personal opinion and I very much understand your urge to generate revenue for your company. An idea, which I would prefer over dual-licensing the complete rsyslog project, is to provide enterprise level plugins under a commercial or dual-license only and generate revenue from those plugins. Evolution (mail and pim application) is such an example, where the project itself is GPL, but the exchange connector (realised via plugins) is commercial. HTH, Michael -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth? From rgerhards at hq.adiscon.com Wed Feb 20 17:50:01 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Wed, 20 Feb 2008 17:50:01 +0100 Subject: [rsyslog] Feedback Requested: Dual-Licensing rsyslog In-Reply-To: References: <577465F99B41C842AAFBE9ED71E70ABA3089C6@grfint2.intern.adiscon.com> Message-ID: <577465F99B41C842AAFBE9ED71E70ABA3089D5@grfint2.intern.adiscon.com> Hi Michael and all, thanks for the feedback, much appreciated. At first, please let me re-iterate that I honestly seek such feedback and nobody (at least over here) has made up his mind ;) So... > > Feedback, please... > > Tbh, I have mixed feelings about that. > First of all, I have to say, that I'm not a lawyer, do don't take my > words for granted. > But as the original source code is licensed under the GPL (at least > parts of it like klogd and pidfile.c), and is copyright of the > original authors, you can't just relicense it. > You'd have to ask the original authors for permission. I missed to explain this: of course, the original source can not be relicensed. What I am most concerned about is new code and especially code that I intend to pull from Adiscon's closed source projects. Things like the queue w/ worker pool and the upcoming RFC 3195 part. > Second, I don't think that simply providing a wiki page, stating that > for all contributions the copyright is automatically transferred to > adiscon is legally effective. You definitely have to ask a lawyer for > clarification here. > For dual-licensed projects I know, like e.g. Qt, I know that they > don't/can't accept contributions (afaik even simple bug fixes) without > such a waiver. That's a major pain. I fully agree. I'll try to get a clarification. If we need a written waiver, that's a no-go. > As a result (at least from my experience), many people avoid to > contribute to such dual-licensed projects. > If you take Qt or MySQL again, you'll see that they are almost 100% > developed by the company itself. The flow of external contributions is > very little. > If you remember the latest discussion on the debian-devel mailing > list, you will remember that the current license of rsyslog was > mentioned as a definite advantage over syslog-ng. Yes, and that's one of the reasons I would like to discuss it *in depth* before any move is made :) > Imho the acceptance and the participation in the community will be > higher if rsyslog stayed a gpl only project. Again, this is only my > personal opinion and I very much understand your urge to generate > revenue for your company. > > An idea, which I would prefer over dual-licensing the complete rsyslog > project, is to provide enterprise level plugins under a commercial or > dual-license only and generate revenue from those plugins. > Evolution (mail and pim application) is such an example, where the > project itself is GPL, but the exchange connector (realised via > plugins) is commercial. This idea is interesting. Thank to the design, we are quite modular. And will become even more modular. Actually, *every* object will soon be (automatically, relax ;)) be loadable. When I am done with basic expressions, I'll take a deep look at this as part of loadable function support. I already have a lot of pieces on my mind, just need to pull them together. So I could take e.g. the RFC 3195 code and offer *just it* dual-licensed. Then, we need the painful waiver only for these parts. Doable. But I have to admit I don't like it. I agree it is probably the best approach to circumvent problems. But on first look it stinks ;) If dual-licensing causes grief to the project, it doesn't feel right to let it cause grief to some parts of the project. And the sample is a well-chosen one: the BEEP (3195) support will probably become *the* cornerstone in rsyslog protocol support (that's the reason I go for it). So does it sound good to make it a second-class citizen? Mmmmhhh... Of course, I also need to discuss internally. But I'd prefer to keep rsyslog components under a single license - even if that means we need to put everything under GPLv3 only. Or am I going overboard here? Please comment. > > HTH Indeed, it does. :) Rainer From rgerhards at hq.adiscon.com Thu Feb 21 10:47:25 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Thu, 21 Feb 2008 10:47:25 +0100 Subject: [rsyslog] rsyslog 3.11.4 released Message-ID: <577465F99B41C842AAFBE9ED71E70ABA3089E3@grfint2.intern.adiscon.com> Hi all, Rsyslog 3.11.4 has been released today. It is a maintenance release, providing some bugfixes and internal code cleanup. Feature-wise, the $MainMessageQueueDiscardSeverity config directive has been enhanced to support user-friendly severity names in addition to numbers. There is also a fix for a potential segfault. Version 3.11.4 is a recommended update for all users of the v3 branch. Changelog: http://www.rsyslog.com/Article179.phtml Download: http://www.rsyslog.com/Downloads-req-getit-lid-81.phtml As always, feedback is appreciated. And as a side-note, the upcoming next major feature is full expression support for filters, as briefly outlined in my blog: http://rgerhards.blogspot.com/2008/02/on-way-to-expression-support.html Best regards, Rainer Gerhards From rgerhards at hq.adiscon.com Fri Feb 22 11:52:08 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Fri, 22 Feb 2008 11:52:08 +0100 Subject: [rsyslog] Contributor page on rsyslog.com Message-ID: <577465F99B41C842AAFBE9ED71E70ABA3089FB@grfint2.intern.adiscon.com> Hi all, and especially those that have contributed, I already (hopefully ;)) provide proper credit for all contributions in the CVS comments and the changelog. However, I feel that you deserve better visibility. As such, we begin to experiment with a contributor database, which intends to replace the infamous "Contributor Hall of Fame" document from the doc set. You may see a glimpse of it, in various stages of completion, on the rsyslog home page. This is an ongoing process and the result in the next days may not be optimal. Most importantly, the database is currently missing past contributions, which obviously is a bad thing. I will be working on getting it is accurate as possible during the next few weeks (the older the patch, the more I need to dig as I didn't archive patches themselves). Please bear with me, my priority still is on new code ;) I hope the new system is useful. Comments and suggestions are appreciated. Please visit http://www.rsyslog.com/ to see how things progress. Thanks, Rainer From rgerhards at hq.adiscon.com Sat Feb 23 10:54:58 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Sat, 23 Feb 2008 10:54:58 +0100 Subject: [rsyslog] Some rsyslog futures and a funny thing named "rainerscript" Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308A03@grfint2.intern.adiscon.com> Hi folks, please have a look at http://rgerhards.blogspot.com/2008/02/introducing-rainerscript-and-some. html Feedback is appreciated. Thanks, Rainer From friedl at hq.adiscon.com Mon Feb 25 09:54:55 2008 From: friedl at hq.adiscon.com (Florian Riedl) Date: Mon, 25 Feb 2008 09:54:55 +0100 Subject: [rsyslog] rsyslog 3.11.5 released In-Reply-To: <577465F99B41C842AAFBE9ED71E70ABA308A0B@grfint2.intern.adiscon.com> References: <577465F99B41C842AAFBE9ED71E70ABA308A0B@grfint2.intern.adiscon.com> Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308A0D@grfint2.intern.adiscon.com> Hi all, Rsyslog 3.11.5 has been released today. It is a minor feature upgrade release. Most importantly, the GSSAPI input module has become an independent module. Formerly, the rsyslog core needed to be linked with GSSAPI libraries, which now no longer is required. Also, there now is an initial implementation of the pre-v3 compatibility layer and duplicated $ModLoad's are now detected and prevented. Release 3.11.5 is a recommended update for all v3 users. Changelog: http://www.rsyslog.com/Article181.phtml Download: http://www.rsyslog.com/Downloads-req-getit-lid-82.phtml Best regards, Florian Riedl From rgerhards at hq.adiscon.com Mon Feb 25 12:00:59 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Mon, 25 Feb 2008 12:00:59 +0100 Subject: [rsyslog] Feedback requested: case sensitive of message property names Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308A15@grfint2.intern.adiscon.com> Hi all, I'd like to ask for feedback. Currently, message properties are case sensitive. See http://www.rsyslog.com/doc-property_replacer.html for a complete list. I have to admit I think I was a fool when I made them case-sensitive. I am currently thinking about making them case-insensitive. Feedback on the issue would be appreciated. This is part of the effort to implement scripting. Thanks, Rainer From Gerrard.Geldenhuis at datacash.com Mon Feb 25 12:04:12 2008 From: Gerrard.Geldenhuis at datacash.com (Gerrard Geldenhuis) Date: Mon, 25 Feb 2008 11:04:12 -0000 Subject: [rsyslog] Feedback requested: case sensitive of message propertynames In-Reply-To: <577465F99B41C842AAFBE9ED71E70ABA308A15@grfint2.intern.adiscon.com> References: <577465F99B41C842AAFBE9ED71E70ABA308A15@grfint2.intern.adiscon.com> Message-ID: Hi If only some of them are case sensitive that is a recipy for confusion. I would vote for conistency either way is fine, personnaly though I prrefer case insensitivity. Regards > -----Original Message----- > From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog- > bounces at lists.adiscon.com] On Behalf Of Rainer Gerhards > Sent: 25 February 2008 11:01 > To: rsyslog-users > Subject: [rsyslog] Feedback requested: case sensitive of message > propertynames > > Hi all, > > I'd like to ask for feedback. Currently, message properties are case > sensitive. See > > http://www.rsyslog.com/doc-property_replacer.html > > for a complete list. I have to admit I think I was a fool when I made > them case-sensitive. I am currently thinking about making them > case-insensitive. Feedback on the issue would be appreciated. This is > part of the effort to implement scripting. > > Thanks, > Rainer > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog From rgerhards at hq.adiscon.com Mon Feb 25 12:06:07 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Mon, 25 Feb 2008 12:06:07 +0100 Subject: [rsyslog] Feedback requested: case sensitive of messagepropertynames In-Reply-To: References: <577465F99B41C842AAFBE9ED71E70ABA308A15@grfint2.intern.adiscon.com> Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308A16@grfint2.intern.adiscon.com> > -----Original Message----- > From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog- > bounces at lists.adiscon.com] On Behalf Of Gerrard Geldenhuis > Sent: Monday, February 25, 2008 12:04 PM > To: rsyslog-users > Subject: Re: [rsyslog] Feedback requested: case sensitive of > messagepropertynames > > Hi > If only some of them are case sensitive that is a recipy for confusion. Good point I forgot to mention that: the question actually arises out of consistency. Because if I change it for the scripting/expression, it must also change for the (currently existing) template system. That should case no backward-compatibility issue, as the current names would still be recogniced. > I would vote for conistency either way is fine, personnaly though I > prrefer case insensitivity. > > Regards > > > -----Original Message----- > > From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog- > > bounces at lists.adiscon.com] On Behalf Of Rainer Gerhards > > Sent: 25 February 2008 11:01 > > To: rsyslog-users > > Subject: [rsyslog] Feedback requested: case sensitive of message > > propertynames > > > > Hi all, > > > > I'd like to ask for feedback. Currently, message properties are case > > sensitive. See > > > > http://www.rsyslog.com/doc-property_replacer.html > > > > for a complete list. I have to admit I think I was a fool when I made > > them case-sensitive. I am currently thinking about making them > > case-insensitive. Feedback on the issue would be appreciated. This is > > part of the effort to implement scripting. > > > > Thanks, > > Rainer > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog From mbiebl at gmail.com Mon Feb 25 15:24:54 2008 From: mbiebl at gmail.com (Michael Biebl) Date: Mon, 25 Feb 2008 15:24:54 +0100 Subject: [rsyslog] Some rsyslog futures and a funny thing named "rainerscript" In-Reply-To: <577465F99B41C842AAFBE9ED71E70ABA308A03@grfint2.intern.adiscon.com> References: <577465F99B41C842AAFBE9ED71E70ABA308A03@grfint2.intern.adiscon.com> Message-ID: 2008/2/23, Rainer Gerhards : > Hi folks, > > please have a look at > > http://rgerhards.blogspot.com/2008/02/introducing-rainerscript-and-some. > html > > Feedback is appreciated. While looking at http://www.rsyslog.com/doc-rainerscript.html I wondered if using a complete scripting language [1] for configuraton is not making it overly complex and error prone. I specifically means function definition etc. here. But if you really need that kind of flexibility and scripting capabilites, have you considered to use existing languages, like lua [2], which were specifically designed to be embedded into applications? Cheers, Michael [1] Not quite complete, as loop constructs are missing. [2] http://www.lua.org -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth? From mbiebl at gmail.com Mon Feb 25 15:39:10 2008 From: mbiebl at gmail.com (Michael Biebl) Date: Mon, 25 Feb 2008 15:39:10 +0100 Subject: [rsyslog] rsyslog 3.11.5 released In-Reply-To: <577465F99B41C842AAFBE9ED71E70ABA308A0D@grfint2.intern.adiscon.com> References: <577465F99B41C842AAFBE9ED71E70ABA308A0B@grfint2.intern.adiscon.com> <577465F99B41C842AAFBE9ED71E70ABA308A0D@grfint2.intern.adiscon.com> Message-ID: Hi 2008/2/25, Florian Riedl : > release. Most importantly, the GSSAPI input module has become an > independent module. Formerly, the rsyslog core needed to be linked with > GSSAPI libraries, which now no longer is required. Also, there now is an Hm, rsyslogd_LDADD in Makefile.am still has $(gss_libs). So when you enable the GSSAPI support, rsyslogd will be linked against the GSSAPI libraries. Has it been forgotten to remove $(gss_libs) while modularizing gssapi? Cheers, Michael -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth? From rgerhards at hq.adiscon.com Mon Feb 25 15:39:14 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Mon, 25 Feb 2008 15:39:14 +0100 Subject: [rsyslog] Some rsyslog futures and a funny thing named"rainerscript" In-Reply-To: References: <577465F99B41C842AAFBE9ED71E70ABA308A03@grfint2.intern.adiscon.com> Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308A22@grfint2.intern.adiscon.com> Hi Michael, thanks for the feedback. My comments inline below. Rainer > -----Original Message----- > From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog- > bounces at lists.adiscon.com] On Behalf Of Michael Biebl > Sent: Monday, February 25, 2008 3:25 PM > To: rsyslog-users > Subject: Re: [rsyslog] Some rsyslog futures and a funny thing > named"rainerscript" > > 2008/2/23, Rainer Gerhards : > > Hi folks, > > > > please have a look at > > > > http://rgerhards.blogspot.com/2008/02/introducing-rainerscript-and- > some. > > html > > > > Feedback is appreciated. > > While looking at > http://www.rsyslog.com/doc-rainerscript.html > I wondered if using a complete scripting language [1] for configuraton > is not making it overly complex and error prone. I specifically means > function definition etc. here. The key is that I will model it so that the complexity is only seen when it is actually needed. Most importantly, it will continue to understand plain old syslog.conf format. So most peoply will probably never see the scripting features. HOWEVER, I think it is useful to have these for a few select folks who really need them. Function definitions, for example, will counter syslog-ng's feature to define a filter. I don't know if it is actually worth and useful to define a filter to reuse it. But with the function, you can do it. So those coming from syslog-ng can find their favorite feature ;) I think it is probably worth to think about how I came to the idea of scripting support. The root cause is complex logic, complex expressions. A few days ago I started to implement them ... and quickly found out that actually the easiest way is "to do it right". So I now have a parse, bytecode and an interpreter/virtual machine running in rsyslog. All of this "just" to support complex expressions. While I thought about it, I finally realized that it takes just a little bit to extend these things so that the end result will be an easy to use scripting facility. That also solves the config file issues that's dangeling so long and, as a side-effect, brings up some interesting options (for those that have need for it). For example, I thought about how to best handle rewriting message content. Now, the solution is obvious. I'll implement a "set" facility in the language that enables message variables to be rewritten on the fly (e.g. for folks who would like to drop some parts of the message). I agree, all not pretty mainstream, but useful in some cases. And keep in mind that it comes at a (complexity) cost only if you need it. That's based on the fact that expression support was originally planned as a by-line of the current config format, so it needed to work with the rest in any way ;) > > But if you really need that kind of flexibility and scripting > capabilites, have you considered to use existing languages, like lua > [2], which were specifically designed to be embedded into > applications? Not really, because of the way it has evolved. A know a new language is already evil, but I see big benefit for the project this time. The reason is that I can very tightly integrate it into rsyslog's features like the upcoming loader. So it will be very cleanly and efficiently integrated. For example, I don't think that I could support old-style format *just within* the new style format with any third-party engine. > Cheers, > Michael > > > [1] Not quite complete, as loop constructs are missing. The ABNF is incompelte ;) but I'll add only what can be of use for syslog and I am currently in doubt loops will be. The VM, however, would be able to handle it, it's very generically written (have a look at vm.c, has much grown today). From mbiebl at gmail.com Mon Feb 25 15:51:28 2008 From: mbiebl at gmail.com (Michael Biebl) Date: Mon, 25 Feb 2008 15:51:28 +0100 Subject: [rsyslog] rsyslog 3.11.5 released In-Reply-To: References: <577465F99B41C842AAFBE9ED71E70ABA308A0B@grfint2.intern.adiscon.com> <577465F99B41C842AAFBE9ED71E70ABA308A0D@grfint2.intern.adiscon.com> Message-ID: 2008/2/25, Michael Biebl : > Hi > > 2008/2/25, Florian Riedl : > > > release. Most importantly, the GSSAPI input module has become an > > independent module. Formerly, the rsyslog core needed to be linked with > > GSSAPI libraries, which now no longer is required. Also, there now is an > > > Hm, rsyslogd_LDADD in Makefile.am still has $(gss_libs). > So when you enable the GSSAPI support, rsyslogd will be linked against > the GSSAPI libraries. Has it been forgotten to remove $(gss_libs) > while modularizing gssapi? Some more comments: plugins/imtcp/Makefile.am builds imgssapi uncoditionally. Shouldn't imgssapi not be surrounded by if ENABLE_GSSAPI imgssapi_* ... endif Also, rsyslogd_SOURCES still contains gss_misc.* and syslogd.c and net.c also have #ifdef USE_GSSAPI code. So it's not yet really possible to build the GSSAPI support in a separate module without linking the rsyslogd core against the GSSAPI libs. The changelog is thus a bit misleading. Cheers, Michael -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth? From rgerhards at hq.adiscon.com Mon Feb 25 15:52:59 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Mon, 25 Feb 2008 15:52:59 +0100 Subject: [rsyslog] rsyslog 3.11.5 released In-Reply-To: References: <577465F99B41C842AAFBE9ED71E70ABA308A0B@grfint2.intern.adiscon.com><577465F99B41C842AAFBE9ED71E70ABA308A0D@grfint2.intern.adiscon.com> Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308A24@grfint2.intern.adiscon.com> Hi Michael, thanks for the feedback. I have probably misunderstood the change, I will talk with the contributors. For the time being, please all consider this to be a bug. Rainer > -----Original Message----- > From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog- > bounces at lists.adiscon.com] On Behalf Of Michael Biebl > Sent: Monday, February 25, 2008 3:51 PM > To: rsyslog-users > Subject: Re: [rsyslog] rsyslog 3.11.5 released > > 2008/2/25, Michael Biebl : > > Hi > > > > 2008/2/25, Florian Riedl : > > > > > release. Most importantly, the GSSAPI input module has become an > > > independent module. Formerly, the rsyslog core needed to be > linked with > > > GSSAPI libraries, which now no longer is required. Also, there > now is an > > > > > > Hm, rsyslogd_LDADD in Makefile.am still has $(gss_libs). > > So when you enable the GSSAPI support, rsyslogd will be linked > against > > the GSSAPI libraries. Has it been forgotten to remove $(gss_libs) > > while modularizing gssapi? > > Some more comments: > plugins/imtcp/Makefile.am > builds imgssapi uncoditionally. Shouldn't imgssapi not be surrounded by > if ENABLE_GSSAPI > imgssapi_* > ... > endif > > Also, rsyslogd_SOURCES still contains gss_misc.* and syslogd.c and > net.c also have #ifdef USE_GSSAPI code. So it's not yet really > possible to build the GSSAPI support in a separate module without > linking the rsyslogd core against the GSSAPI libs. > The changelog is thus a bit misleading. > > Cheers, > Michael > > -- > Why is it that all of the instruments seeking intelligent life in the > universe are pointed away from Earth? > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog From mbiebl at gmail.com Mon Feb 25 16:36:01 2008 From: mbiebl at gmail.com (Michael Biebl) Date: Mon, 25 Feb 2008 16:36:01 +0100 Subject: [rsyslog] rsyslog 3.11.5 released In-Reply-To: <577465F99B41C842AAFBE9ED71E70ABA308A24@grfint2.intern.adiscon.com> References: <577465F99B41C842AAFBE9ED71E70ABA308A0B@grfint2.intern.adiscon.com> <577465F99B41C842AAFBE9ED71E70ABA308A0D@grfint2.intern.adiscon.com> <577465F99B41C842AAFBE9ED71E70ABA308A24@grfint2.intern.adiscon.com> Message-ID: 2008/2/25, Rainer Gerhards : > Hi Michael, > > thanks for the feedback. I have probably misunderstood the change, I > will talk with the contributors. For the time being, please all consider > this to be a bug. One more question: If you enable gssapi support (which is built from imtcp.c), can you actually load both imtcp *and* imgssapi at the same time. Imo it will lead to conflicts. Cheers, Michael -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth? From rgerhards at hq.adiscon.com Mon Feb 25 16:37:43 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Mon, 25 Feb 2008 16:37:43 +0100 Subject: [rsyslog] rsyslog 3.11.5 released In-Reply-To: References: <577465F99B41C842AAFBE9ED71E70ABA308A0B@grfint2.intern.adiscon.com><577465F99B41C842AAFBE9ED71E70ABA308A0D@grfint2.intern.adiscon.com><577465F99B41C842AAFBE9ED71E70ABA308A24@grfint2.intern.adiscon.com> Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308A26@grfint2.intern.adiscon.com> > One more question: > If you enable gssapi support (which is built from imtcp.c), can you > actually load both imtcp *and* imgssapi at the same time. Imo it will > lead to conflicts. Yes, you are right. This is documented (at least I hope one can understand it ;)) and is currently not supported. To fix it, we need the rsyslog loader (just like with the generic database action). So it is a temporary quirk. Rainer From theinric at redhat.com Mon Feb 25 18:35:58 2008 From: theinric at redhat.com (theinric at redhat.com) Date: Mon, 25 Feb 2008 18:35:58 +0100 Subject: [rsyslog] rsyslog 3.11.5 released In-Reply-To: References: <577465F99B41C842AAFBE9ED71E70ABA308A0B@grfint2.intern.adiscon.com> <577465F99B41C842AAFBE9ED71E70ABA308A0D@grfint2.intern.adiscon.com> Message-ID: <47C2FC7E.2040303@redhat.com> On 02/25/2008 03:51 PM, Michael Biebl wrote: > 2008/2/25, Michael Biebl : >> Hi >> >> 2008/2/25, Florian Riedl : >> >>> release. Most importantly, the GSSAPI input module has become an >> > independent module. Formerly, the rsyslog core needed to be linked with >> > GSSAPI libraries, which now no longer is required. Also, there now is an >> >> >> Hm, rsyslogd_LDADD in Makefile.am still has $(gss_libs). >> So when you enable the GSSAPI support, rsyslogd will be linked against >> the GSSAPI libraries. Has it been forgotten to remove $(gss_libs) >> while modularizing gssapi? > > Some more comments: > plugins/imtcp/Makefile.am > builds imgssapi uncoditionally. Shouldn't imgssapi not be surrounded by > if ENABLE_GSSAPI > imgssapi_* > ... > endif > > Also, rsyslogd_SOURCES still contains gss_misc.* and syslogd.c and > net.c also have #ifdef USE_GSSAPI code. So it's not yet really > possible to build the GSSAPI support in a separate module without > linking the rsyslogd core against the GSSAPI libs. > The changelog is thus a bit misleading. > > Cheers, > Michael Hi Michael, thanks for the comments, attached patch should resolve these problems. http://pastebin.com/m638295ac Regarding the #ifdefs in syslogd.c and net.c, they are used to conditionally compile some options, allowed senders list and such, no external GSSAPI code is needed so really only the module needs to be linked with the GSSAPI libs. From mbiebl at gmail.com Mon Feb 25 19:18:56 2008 From: mbiebl at gmail.com (Michael Biebl) Date: Mon, 25 Feb 2008 19:18:56 +0100 Subject: [rsyslog] rsyslog 3.11.5 released In-Reply-To: <47C2FC7E.2040303@redhat.com> References: <577465F99B41C842AAFBE9ED71E70ABA308A0B@grfint2.intern.adiscon.com> <577465F99B41C842AAFBE9ED71E70ABA308A0D@grfint2.intern.adiscon.com> <47C2FC7E.2040303@redhat.com> Message-ID: 2008/2/25, theinric at redhat.com : > On 02/25/2008 03:51 PM, Michael Biebl wrote: > > 2008/2/25, Michael Biebl : > >> Hi > >> > >> 2008/2/25, Florian Riedl : > >> > >>> release. Most importantly, the GSSAPI input module has become an > >> > independent module. Formerly, the rsyslog core needed to be linked with > >> > GSSAPI libraries, which now no longer is required. Also, there now is an > >> > >> > >> Hm, rsyslogd_LDADD in Makefile.am still has $(gss_libs). > >> So when you enable the GSSAPI support, rsyslogd will be linked against > >> the GSSAPI libraries. Has it been forgotten to remove $(gss_libs) > >> while modularizing gssapi? > > > > Some more comments: > > plugins/imtcp/Makefile.am > > builds imgssapi uncoditionally. Shouldn't imgssapi not be surrounded by > > if ENABLE_GSSAPI > > imgssapi_* > > ... > > endif > > > > Also, rsyslogd_SOURCES still contains gss_misc.* and syslogd.c and > > net.c also have #ifdef USE_GSSAPI code. So it's not yet really > > possible to build the GSSAPI support in a separate module without > > linking the rsyslogd core against the GSSAPI libs. > > The changelog is thus a bit misleading. > > > > Cheers, > > Michael > > > Hi Michael, > > thanks for the comments, attached patch should resolve these problems. > http://pastebin.com/m638295ac > > Regarding the #ifdefs in syslogd.c and net.c, they are used to > conditionally compile some options, allowed senders list and such, no > external GSSAPI code is needed so really only the module needs to be > linked with the GSSAPI libs. > Funny. I basically ended up with the same patch, which I intended to post just a few moments after your email. I initially thought of compiling gss-misc into a convenience libtool library and link imgssapi and omgssapi against it (to avoid the double compilation of gss-misc.c). But then I decided against it, because it was not really worth the effort. One minor issue with your proposed patch: gss-misc.h is not added to the dist tarball. You have 3 options here: 1.) Include it in EXTRA_DIST in Makefile.am 2.) Include it in _SOURCES in plugins/(imtcp,omgssapi)/Makefile.am 3.) Keep it in rsyslogd_SOURCES (ugly) 4.) Add noinst_HEADERS = gss-misc.h to Makefile.am I'd prefer 4. Cheers, Michael -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth? From mbiebl at gmail.com Mon Feb 25 19:19:56 2008 From: mbiebl at gmail.com (Michael Biebl) Date: Mon, 25 Feb 2008 19:19:56 +0100 Subject: [rsyslog] rsyslog 3.11.5 released In-Reply-To: References: <577465F99B41C842AAFBE9ED71E70ABA308A0B@grfint2.intern.adiscon.com> <577465F99B41C842AAFBE9ED71E70ABA308A0D@grfint2.intern.adiscon.com> <47C2FC7E.2040303@redhat.com> Message-ID: 2008/2/25, Michael Biebl : > You have 3 options here: > > I'd prefer 4. Argh, it would help if I could actually count ;-) Cheers, Michael -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth? From mbiebl at gmail.com Tue Feb 26 02:34:54 2008 From: mbiebl at gmail.com (Michael Biebl) Date: Tue, 26 Feb 2008 02:34:54 +0100 Subject: [rsyslog] rsyslog 3.11.5 released In-Reply-To: References: <577465F99B41C842AAFBE9ED71E70ABA308A0B@grfint2.intern.adiscon.com> <577465F99B41C842AAFBE9ED71E70ABA308A0D@grfint2.intern.adiscon.com> <47C2FC7E.2040303@redhat.com> Message-ID: 2008/2/25, Michael Biebl : > I initially thought of compiling gss-misc into a convenience libtool > library and link imgssapi and omgssapi against it (to avoid the double > compilation of gss-misc.c). FWIW, the patch for the covenience library is at http://pastebin.com/m638295ac As I had already done the work, I thought I'd share it anyways. Rainer, take the one which you like better. Cheers, Michael -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth? From mbiebl at gmail.com Tue Feb 26 02:37:27 2008 From: mbiebl at gmail.com (Michael Biebl) Date: Tue, 26 Feb 2008 02:37:27 +0100 Subject: [rsyslog] rsyslog 3.11.5 released In-Reply-To: References: <577465F99B41C842AAFBE9ED71E70ABA308A0B@grfint2.intern.adiscon.com> <577465F99B41C842AAFBE9ED71E70ABA308A0D@grfint2.intern.adiscon.com> <47C2FC7E.2040303@redhat.com> Message-ID: 2008/2/26, Michael Biebl : > 2008/2/25, Michael Biebl : > > > I initially thought of compiling gss-misc into a convenience libtool > > library and link imgssapi and omgssapi against it (to avoid the double > > compilation of gss-misc.c). > > > FWIW, the patch for the covenience library is at > > http://pastebin.com/m638295ac Oops, cut&paste error. The correct link is http://pastebin.com/mcdd2846 Michael -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth? From rgerhards at hq.adiscon.com Tue Feb 26 09:17:53 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Tue, 26 Feb 2008 09:17:53 +0100 Subject: [rsyslog] rsyslog 3.11.5 released In-Reply-To: References: <577465F99B41C842AAFBE9ED71E70ABA308A0B@grfint2.intern.adiscon.com><577465F99B41C842AAFBE9ED71E70ABA308A0D@grfint2.intern.adiscon.com><47C2FC7E.2040303@redhat.com> Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308A30@grfint2.intern.adiscon.com> That was a tough decision ;) I finally took Michael's patch, as it is pointing into the same direction that the rsyslog loader is heading... Now in CVS. I think I'll release a bugfix version later today, but I will also work a bit on the doc, which also is sub-optimal in 3.11.5... Rainer > -----Original Message----- > From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog- > bounces at lists.adiscon.com] On Behalf Of Michael Biebl > Sent: Tuesday, February 26, 2008 2:37 AM > To: rsyslog-users > Subject: Re: [rsyslog] rsyslog 3.11.5 released > > 2008/2/26, Michael Biebl : > > 2008/2/25, Michael Biebl : > > > > > I initially thought of compiling gss-misc into a convenience > libtool > > > library and link imgssapi and omgssapi against it (to avoid the > double > > > compilation of gss-misc.c). > > > > > > FWIW, the patch for the covenience library is at > > > > http://pastebin.com/m638295ac > > Oops, cut&paste error. The correct link is > > http://pastebin.com/mcdd2846 > > Michael > -- > Why is it that all of the instruments seeking intelligent life in the > universe are pointed away from Earth? > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog From Gerrard.Geldenhuis at datacash.com Tue Feb 26 13:42:36 2008 From: Gerrard.Geldenhuis at datacash.com (Gerrard Geldenhuis) Date: Tue, 26 Feb 2008 12:42:36 -0000 Subject: [rsyslog] rsyslog Usage Message-ID: Hi Apologies for being slightly lazy/in a rush. I am reading through the documentation at the moment but I want to do the following: Log to local host and multiple remote hosts. (The same message gets send to multiple hosts) I saw a backup host example but not to two hosts simultaneously, can I log to two hosts simultaneously? Will/can rsyslog buffer log files if the remote host is not available and then sync when the host is available again. And if you are logging to more than one host will this still work. Would disk space be the only limiting factor in buffering files locally? I am using a fedora package which contains the following version: rsyslog-1.19.6-3.fc8 Regards From rgerhards at hq.adiscon.com Tue Feb 26 13:46:30 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Tue, 26 Feb 2008 13:46:30 +0100 Subject: [rsyslog] rsyslog Usage In-Reply-To: References: Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308A41@grfint2.intern.adiscon.com> Just let us get to an understanding of features, howto once we have settle on a version: > -----Original Message----- > From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog- > bounces at lists.adiscon.com] On Behalf Of Gerrard Geldenhuis > Sent: Tuesday, February 26, 2008 1:43 PM > To: rsyslog-users > Subject: [rsyslog] rsyslog Usage > > Hi > > Apologies for being slightly lazy/in a rush. I am reading through the > documentation at the moment but I want to do the following: > > > > Log to local host and multiple remote hosts. (The same message gets > send > to multiple hosts) Absolutely no problem. Just do as many *.* @host1 *.* @host2 *.* @hostn As you like (of course, you can also filter). > I saw a backup host example but not to two hosts simultaneously, can I > log to two hosts simultaneously? Backup is just a special use case. You can use some backups and also - see above - just regular multiple actions. > > > Will/can rsyslog buffer log files if the remote host is not available > and then sync when the host is available again. And if you are logging > to more than one host will this still work. Would disk space be the > only > limiting factor in buffering files locally? Indeed. This talks about databases, but it applies to any action (including write to host): http://www.rsyslog.com/doc-rsyslog_high_database_rate.html The bad news, though, is that you need a recent v3 build... HTH Rainer > > I am using a fedora package which contains the following version: > rsyslog-1.19.6-3.fc8 > > > > Regards > > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog From rgerhards at hq.adiscon.com Tue Feb 26 21:16:55 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Tue, 26 Feb 2008 21:16:55 +0100 Subject: [rsyslog] Feedback Requested Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308A49@grfint2.intern.adiscon.com> Hi all, this is for the developer folks among you. Once again I would like to ask for some feedback on future rsyslog directions. I will soon begin to work on the "rsyslog loader". The loader will "complete" plugin support, as it will allow modules to dynamically load other modules. For example, this will enable all database-writing plugins to uilize a single module (object) that provides a database writing framework. That will further facilitate plugin development. There are several ways to implement this feature. One of them is that each rsyslog object will have its own library, which than is dynamically loaded upon request at runtime. This will probably result in (at least) 20+ libraries. From a performance perspective, there most probably is not a big impact. But you need to take care of these files. Question now: is it desirable to limit the number or core library files? Or doesn't it really matter how many files are there as long as rsyslog handles loading automatically (provided the files are all in a common [rsyslog] search path)? [I have to admit I lean towards the "multi-file" end ;)]. If you have an opinion, I'd really like to hear it. Remember, now is the time to make your input influence what ultimately will be implemented ;) Thanks to all, Rainer From rgerhards at hq.adiscon.com Wed Feb 27 10:57:53 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Wed, 27 Feb 2008 10:57:53 +0100 Subject: [rsyslog] rsyslog moving to git Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308A53@grfint2.intern.adiscon.com> Hi all, I wanted to make you aware that the rsyslog project will move to git for its source control. I plan to do this move some time during the next two weeks (depending on development workload). I will send out another note shortly before the actual date but wanted to make you all aware about the fact. I'd also like to express my deepest thanks to Michael Biebl, who helped us get up and running with git. Without his help, we'd probably stick for much longer with CVS and its quirks ;) As one of the first things after the move, expect the project directory to be cleaned up and restructured, most importantly the code will move into a ./src directory. We haven't done this so far as with CVS this would have meant loss of history. Rainer From rgerhards at hq.adiscon.com Wed Feb 27 18:44:31 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Wed, 27 Feb 2008 18:44:31 +0100 Subject: [rsyslog] rsyslog 3.11.6 released Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308A6B@grfint2.intern.adiscon.com> Hi all, rsyslog 3.11.6 has been released today. It is a bug-fixing release. It fixes a number of bugs related to queue engine termination, each of which could cause a segfault (but only during shutdown or HUP, see change log for details). It also fixes a problem with compatibility mode. Finally, it fixes the bug that caused 3.11.5 core to still link against GSSAPI libraries. Version 3.11.6 is a recommended update for all v3 branch users. Please note, however, that I will most probably release 3.12.0 either tomorrow or Friday, so if you do not experience any problems, you may want to wait for this. Changelog: http://www.rsyslog.com/Article183.phtml Download: http://www.rsyslog.com/Downloads-req-getit-lid-83.phtml I hope this release is useful. Best regards, Rainer Gerhards From rgerhards at hq.adiscon.com Thu Feb 28 12:32:26 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Thu, 28 Feb 2008 12:32:26 +0100 Subject: [rsyslog] rsyslog 3.12.0 released Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308A7D@grfint2.intern.adiscon.com> Hi all, as promised, I have just released rsyslog 3.12.0. It has one new major feature, and that is complex expression support inside filters. For example, you can now do the following [all of this is on *one* line]: if $syslogfacility-text == 'local0' and $msg startswith 'DEVNAME' and ($msg contains 'error1' or $msg contains 'error0') then /var/log/somelog There is no restriction on the complexity of expressions. As with selector lines, you can specify as many "if"-filters as you like. I personally have been waiting very long for this feature, as I consider it core functionality which should be provided. So I am more than happy that we now have it. Please note that I will continue to enhance this facility, ultimately ending up with a simple configuration script language. During that course, some syntax may change, so you may need to slightly modify your configuration files if you upgrade to a later release. Documentation for this feature can be found under "Expression-based Filters" on the rsyslog.conf page: http://www.rsyslog.com/doc-rsyslog_conf.html No other changes or fixes are included in 3.12.0. Changelog: http://www.rsyslog.com/Article185.phtml Download: http://www.rsyslog.com/Downloads-req-getit-lid-84.phtml I hope the new feature is useful. Feedback is appreciated. Rainer From r.bhatia at ipax.at Thu Feb 28 13:04:05 2008 From: r.bhatia at ipax.at (Raoul Bhatia [IPAX]) Date: Thu, 28 Feb 2008 13:04:05 +0100 Subject: [rsyslog] rsyslog moving to git In-Reply-To: <577465F99B41C842AAFBE9ED71E70ABA308A53@grfint2.intern.adiscon.com> References: <577465F99B41C842AAFBE9ED71E70ABA308A53@grfint2.intern.adiscon.com> Message-ID: <47C6A335.3010301@ipax.at> Rainer Gerhards wrote: > I wanted to make you aware that the rsyslog project will move to git for > its source control. I plan to do this move some time during the next two > weeks (depending on development workload). I will send out another note > shortly before the actual date but wanted to make you all aware about > the fact. just for the records, what made you choose git over other options like svn, hg, etc.? especially hg (mercurial) looks very promising, if you really need a distributed scm. cheers, raoul -- ____________________________________________________________________ DI (FH) Raoul Bhatia M.Sc. email. r.bhatia at ipax.at Technischer Leiter IPAX - Aloy Bhatia Hava OEG web. http://www.ipax.at Barawitzkagasse 10/2/2/11 email. office at ipax.at 1190 Wien tel. +43 1 3670030 FN 277995t HG Wien fax. +43 1 3670030 15 ____________________________________________________________________ From rgerhards at hq.adiscon.com Thu Feb 28 13:56:48 2008 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Thu, 28 Feb 2008 13:56:48 +0100 Subject: [rsyslog] rsyslog moving to git In-Reply-To: <47C6A335.3010301@ipax.at> References: <577465F99B41C842AAFBE9ED71E70ABA308A53@grfint2.intern.adiscon.com> <47C6A335.3010301@ipax.at> Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308A81@grfint2.intern.adiscon.com> Hi Raoul, maybe my answer is surprising, but it is honest: it was the support provided by Michael Biebl - that's a killer feature ;) At the bottom line, my primary focus is on coding the greatest syslogd ever. Anything else (like scm) is just something that I must have, but I hope to spend as few time on it as possible. CVS, however, made me feel pain, especially when I tried to restructure the code tree (loss of history). Rainer > -----Original Message----- > From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog- > bounces at lists.adiscon.com] On Behalf Of Raoul Bhatia [IPAX] > Sent: Thursday, February 28, 2008 1:04 PM > To: rsyslog-users > Subject: Re: [rsyslog] rsyslog moving to git > > Rainer Gerhards wrote: > > I wanted to make you aware that the rsyslog project will move to git > for > > its source control. I plan to do this move some time during the next > two > > weeks (depending on development workload). I will send out another > note > > shortly before the actual date but wanted to make you all aware about > > the fact. > > just for the records, what made you choose git over other options like > svn, hg, etc.? especially hg (mercurial) looks very promising, if you > really need a distributed scm. > > cheers, > raoul > -- > ____________________________________________________________________ > DI (FH) Raoul Bhatia M.Sc. email. r.bhatia at ipax.at > Technischer Leiter > > IPAX - Aloy Bhatia Hava OEG web. http://www.ipax.at > Barawitzkagasse 10/2/2/11 email. office at ipax.at > 1190 Wien tel. +43 1 3670030 > FN 277995t HG Wien fax. +43 1 3670030 15 > ____________________________________________________________________ > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog From mbiebl at gmail.com Thu Feb 28 15:27:55 2008 From: mbiebl at gmail.com (Michael Biebl) Date: Thu, 28 Feb 2008 15:27:55 +0100 Subject: [rsyslog] rsyslog moving to git In-Reply-To: <47C6A335.3010301@ipax.at> References: <577465F99B41C842AAFBE9ED71E70ABA308A53@grfint2.intern.adiscon.com> <47C6A335.3010301@ipax.at> Message-ID: 2008/2/28, Raoul Bhatia [IPAX] : > Rainer Gerhards wrote: > > I wanted to make you aware that the rsyslog project will move to git for > > its source control. I plan to do this move some time during the next two > > weeks (depending on development workload). I will send out another note > > shortly before the actual date but wanted to make you all aware about > > the fact. > > > just for the records, what made you choose git over other options like > svn, hg, etc.? especially hg (mercurial) looks very promising, if you > really need a distributed scm. Why not svn? Surely svn is a bit better than CVS but imho it already has reached it's peak. There are better tools available nowadays. If we do the switch (and the work that is necessary for that) today, it makes sense to pick the most capable (D)SCM. Why git? It's fast, it has unique features, it has proven its credibility (see kernel, xorg etc). There is strong momentum behind git in the community and overall support is good. Recent versions (< 1.5) were a bit hard to handle, but the UI got much better recently and also the docs have improved noticably. Imho git is a good choice. Cheers, Michael -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth?