From rgerhards at hq.adiscon.com  Wed Jan  2 14:27:43 2008
From: rgerhards at hq.adiscon.com (Rainer Gerhards)
Date: Wed, 2 Jan 2008 14:27:43 +0100
Subject: [rsyslog] Rsyslog 2.0.0 STABLE released
Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308708@grfint2.intern.adiscon.com>

Hi all,

I have just released stable branch version 2.0.0. It brings all features
of 1.21.2 to the stable branch of rsyslog. As such, it offers a myriad
of new features to users of the previous stable version (1.0.5).
Examples are loadable output plugins and PostgreSQL support. Stable
2.0.0 is a recommended update for all stable branch users. Version 1.0.5
will no longer be supported.

Please note that there is no code difference between 1.21.2 and 2.0.0.
So if you already run 1.21.2, there is no point in updating to that
release.

Rsyslog development will continue with version v3. I expect to provide a
first "official" v3 version soon. Keep in mind, though, that the config
file syntax will not be fully backwards-compatible.

Rainer

From rgerhards at hq.adiscon.com  Mon Jan  7 08:38:14 2008
From: rgerhards at hq.adiscon.com (Rainer Gerhards)
Date: Mon, 7 Jan 2008 08:38:14 +0100
Subject: [rsyslog] rsyslog 3.10.0 released
Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308725@grfint2.intern.adiscon.com>

Hi all,

Rsyslog 3.10.0 has been released today. It is the initial release of the
v3 development branch. It offers many new features, among others
loadable input modules and a much enhanced threading model. Rklogd is
now tightly integrated as an input plugin. UDP listeners can now be
bound to specific local interfaces/ports and multiple of them can be run
concurrently. There are many other enhancements. This release has a
number of known backward compatibility issues, be sure to review the
compatibility information in the documentation set. Rsyslog v3 is not
yet recommended on production machines.

The primary reason for release is that we would like to gain some
experience from the field. However, given the magnitude of change, the
code looks quite solid.

To review the compatibility notes, please visit

http://www.rsyslog.com/module-Static_Docs-view-f-v3compatibility.html.ph
tml

Please note that even though the first v3 version has been released, I
will continue to add features and capabilities rapidly. Expect new
releases soon. As always, feedback is highly appreciated. It would be
most valuable to make the v3 branch a practical alternative on
production systems.

Rainer Gerhards

From rgerhards at hq.adiscon.com  Thu Jan 10 15:26:06 2008
From: rgerhards at hq.adiscon.com (Rainer Gerhards)
Date: Thu, 10 Jan 2008 15:26:06 +0100
Subject: [rsyslog] rsyslog 3.10.1
Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308743@grfint2.intern.adiscon.com>

There is a bug in 3.10.1 - will re-release soon, please stand by...

Rainer

From rgerhards at hq.adiscon.com  Thu Jan 10 15:30:51 2008
From: rgerhards at hq.adiscon.com (Rainer Gerhards)
Date: Thu, 10 Jan 2008 15:30:51 +0100
Subject: [rsyslog] rsyslog 3.10.1
Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308744@grfint2.intern.adiscon.com>

Hi all,

there was an issue when $WorkDirectory was not set. It lead to an
immediate segfault upon startup. This is now corrected and re-released.
If in doubt, have a look at the md5 sum.

Sorry for any inconvenience. I'd appreciate if some could try out 3.10.1
as feedback would be very valuable. I hope to have a more useful queue
up and running soon.

Rainer 

From mbiebl at gmail.com  Thu Jan 10 15:51:52 2008
From: mbiebl at gmail.com (Michael Biebl)
Date: Thu, 10 Jan 2008 15:51:52 +0100
Subject: [rsyslog] rsyslog 3.10.1
In-Reply-To: <577465F99B41C842AAFBE9ED71E70ABA308744@grfint2.intern.adiscon.com>
References: <577465F99B41C842AAFBE9ED71E70ABA308744@grfint2.intern.adiscon.com>
Message-ID: <aa76cdac0801100651m3d640bb0l7021eed4923df6b9@mail.gmail.com>

2008/1/10, Rainer Gerhards <rgerhards at hq.adiscon.com>:
> Hi all,
>
> there was an issue when $WorkDirectory was not set. It lead to an
> immediate segfault upon startup. This is now corrected and re-released.
> If in doubt, have a look at the md5 sum.
>
> Sorry for any inconvenience. I'd appreciate if some could try out 3.10.1
> as feedback would be very valuable. I hope to have a more useful queue
> up and running soon.

Tested imuxsock, imklog and imudp lightly. Seems to work fine so far.

Cheers,
Michael

-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

From rgerhards at hq.adiscon.com  Wed Jan 16 08:24:02 2008
From: rgerhards at hq.adiscon.com (Rainer Gerhards)
Date: Wed, 16 Jan 2008 08:24:02 +0100
Subject: [rsyslog] Compile Problem with rsyslog 3.10.2
Message-ID: <577465F99B41C842AAFBE9ED71E70ABA30876A@grfint2.intern.adiscon.com>

Hi all,

Michael Biebl pointed out a problem in rsyslog 3.10.2 release build. It
does not compile due to a problem in obj-types.h.

I will provide a fix today, most probably in form of a new version which
is mostly ready. I'll timeout this noon.

Sorry for any hassle - and thanks for reporting!

Rainer

From rgerhards at hq.adiscon.com  Wed Jan 16 10:48:24 2008
From: rgerhards at hq.adiscon.com (Rainer Gerhards)
Date: Wed, 16 Jan 2008 10:48:24 +0100
Subject: [rsyslog] rsyslog 3.10.2 re-released
Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308775@grfint2.intern.adiscon.com>

Hi all,

I have re-released 3.10.2:

http://www.rsyslog.com/Downloads-req-getit-lid-73.phtml

I noticed that I may get into trouble having a solid 3.10.3 by noon
today ;)

Rainer

From skvidal at fedoraproject.org  Wed Jan 16 15:53:36 2008
From: skvidal at fedoraproject.org (seth vidal)
Date: Wed, 16 Jan 2008 09:53:36 -0500
Subject: [rsyslog] ringbuffer log destination
Message-ID: <1200495216.15198.48.camel@cutter>

Would it be possible/easy to setup a ringbuffer log destination? Like
dmesg under linux it would be very useful to me to have a ringbuffer
log. On my laptop, for example, I don't often need more than the last
30-60 minutes of logs for fixing problems. And it'd make it more
possible to have limited logs if we could do something in rsyslog like:

*.info;mail.none;authpriv.none;cron.none  ringbuffer(/var/log/messages,
8192)

I was actually thinking about using an SD card or usb key as my 'hard
drive' and I want to limit unnecessary writes. So, if I could log
to /dev/shm and limit the total size of the logs via ringbuffer to 10M
or 20M then I'd not eat up much memory and none of the writes would be
to media with a limited write count.

Would this be something you'd consider adding? Or maybe I've not looked
hard enough and it's available now?

Thanks,
-sv



From patrick at patricktsang.net  Wed Jan 16 16:34:22 2008
From: patrick at patricktsang.net (Patrick T. Tsang)
Date: Wed, 16 Jan 2008 23:34:22 +0800
Subject: [rsyslog] ringbuffer log destination
References: <1200495216.15198.48.camel@cutter>
Message-ID: <01ed01c85855$449b44f0$9802a8c0@ibmt42>

Hello,

This is a very great idea. 
would it be possible to work with logrotate?

thanks


----- Original Message ----- 
From: "seth vidal" <skvidal at fedoraproject.org>
To: <rsyslog at lists.adiscon.com>
Sent: Wednesday, January 16, 2008 10:53 PM
Subject: [rsyslog] ringbuffer log destination


> Would it be possible/easy to setup a ringbuffer log destination? Like
> dmesg under linux it would be very useful to me to have a ringbuffer
> log. On my laptop, for example, I don't often need more than the last
> 30-60 minutes of logs for fixing problems. And it'd make it more
> possible to have limited logs if we could do something in rsyslog like:
> 
> *.info;mail.none;authpriv.none;cron.none  ringbuffer(/var/log/messages,
> 8192)
> 
> I was actually thinking about using an SD card or usb key as my 'hard
> drive' and I want to limit unnecessary writes. So, if I could log
> to /dev/shm and limit the total size of the logs via ringbuffer to 10M
> or 20M then I'd not eat up much memory and none of the writes would be
> to media with a limited write count.
> 
> Would this be something you'd consider adding? Or maybe I've not looked
> hard enough and it's available now?
> 
> Thanks,
> -sv
> 
> 
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
>


From skvidal at fedoraproject.org  Wed Jan 16 17:00:52 2008
From: skvidal at fedoraproject.org (seth vidal)
Date: Wed, 16 Jan 2008 11:00:52 -0500
Subject: [rsyslog] ringbuffer log destination
In-Reply-To: <01ed01c85855$449b44f0$9802a8c0@ibmt42>
References: <1200495216.15198.48.camel@cutter>
	<01ed01c85855$449b44f0$9802a8c0@ibmt42>
Message-ID: <1200499252.15198.55.camel@cutter>


On Wed, 2008-01-16 at 23:34 +0800, Patrick T. Tsang wrote:
> Hello,
> 
> This is a very great idea. 
> would it be possible to work with logrotate?
> 

I don't know, actually. I guess if you were logging to /dev/shm it would
just write the logrotate files out and you could either remove them or
reboot and nuke all of the logs.

-sv



From rgerhards at hq.adiscon.com  Wed Jan 16 17:21:17 2008
From: rgerhards at hq.adiscon.com (Rainer Gerhards)
Date: Wed, 16 Jan 2008 17:21:17 +0100
Subject: [rsyslog] ringbuffer log destination
In-Reply-To: <1200495216.15198.48.camel@cutter>
References: <1200495216.15198.48.camel@cutter>
Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308786@grfint2.intern.adiscon.com>

Hi sv and others,

logrotate may do the job, but I don't like that approach (requires
huping and is too loosely coupled for my taste).

There is a $outchannel directive in rsyslog, that can probably be
(ab)used for this use case:

http://www.rsyslog.com/module-Static_Docs-view-f-rsyslog_conf.html.phtml
search for "Output Channels"

HOWEVER, $outchannel is legacy for a design idea that didn't work out.
It will be removed in the future (or probably be carried as a legacy
that will receive no further development). But it may still do the trick
in the very next time.

The real answer is different and there is good news. I am currently
implementing on disk-queueing including store-and-forward actions (e.g.
spool to disk if destination syslog server is unavailable and send the
spooled data as soon as it comes back on). I have made good progress
with that and hope to have the feature available by the end of the
month.

As a side-effect, I developed as stream class which can write circular
logs (and a number of other cool things). Once store-and-forward is
ready, I'll take that stream class and modify the output file writer to
utilize it. Then, circular logging will be available as a native
feature. I hope to have this ready by mid-February, of course, all
depending on how things progress...

The bad thing is that you'll probably see a number of oddly-looking
config directives, but for the time being I have given features
precedence over log file format. It may (may!) look like something along
these lines:

$ActionFileWriteMode circular
$ActionFileMaxSize 8192k
$ActionFileDir /var/log
$ActionFilePrefix messages
*.info;mail.none;authpriv.none;cron.none  :omfile:

Yes, it is ugly ;) But it needs to fit into the currently available
config classes. You may cast your future config format ballot here:

http://rgerhards.blogspot.com/2007/08/on-rsyslog-config-file-format.html

I have to admit, though, that I think it will be mid-2008 before I
revisit the config file format. After the output writer, full expression
support is the next major feature on my agenda.

Comments welcome,
Rainer

> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of seth vidal
> Sent: Wednesday, January 16, 2008 3:54 PM
> To: rsyslog at lists.adiscon.com
> Subject: [rsyslog] ringbuffer log destination
> 
> Would it be possible/easy to setup a ringbuffer log destination? Like
> dmesg under linux it would be very useful to me to have a ringbuffer
> log. On my laptop, for example, I don't often need more than the last
> 30-60 minutes of logs for fixing problems. And it'd make it more
> possible to have limited logs if we could do something in rsyslog
like:
> 
> *.info;mail.none;authpriv.none;cron.none
ringbuffer(/var/log/messages,
> 8192)
> 
> I was actually thinking about using an SD card or usb key as my 'hard
> drive' and I want to limit unnecessary writes. So, if I could log
> to /dev/shm and limit the total size of the logs via ringbuffer to 10M
> or 20M then I'd not eat up much memory and none of the writes would be
> to media with a limited write count.
> 
> Would this be something you'd consider adding? Or maybe I've not
looked
> hard enough and it's available now?
> 
> Thanks,
> -sv
> 
> 
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog

From bakers at web-ster.com  Wed Jan 16 18:58:13 2008
From: bakers at web-ster.com (Scott Baker)
Date: Wed, 16 Jan 2008 09:58:13 -0800
Subject: [rsyslog] Max Log Size
Message-ID: <478E45B5.70703@web-ster.com>

Seth Vidal asks a good question:

http://skvidal.wordpress.com/2008/01/16/fixed-size-log-outputs/

Basically he wants to know if you can have syslog output a fixed log 
size, and the roll to another name? So say I only wanted 1 meg log 
files, and then after I reach 1 meg change the name too foobar.log.1 
or something.

I swear I thought this was possible with rsyslog, but I can't find 
anything in the docs. Is it possible? Was I hallucinating when I 
remembered this feature?

-- 
Scott Baker - Canby Telcom
RHCE - System Administrator - 503.266.8253

From rgerhards at hq.adiscon.com  Wed Jan 16 20:24:50 2008
From: rgerhards at hq.adiscon.com (Rainer Gerhards)
Date: Wed, 16 Jan 2008 20:24:50 +0100
Subject: [rsyslog] Max Log Size
Message-ID: <000b01c85875$7ac61c58$060013ac@intern.adiscon.com>

I am right now on a pda. I answered that a few hours ago, pls look at the mailing list archive, dont have it at hand for quoting. Pls keep asking ;)

Rainer

----- Urspr?ngliche Nachricht -----
Von: "Scott Baker" <bakers at web-ster.com>
An: "rsyslog-users" <rsyslog at lists.adiscon.com>
Gesendet: 16.01.08 18:58
Betreff: [rsyslog] Max Log Size

Seth Vidal asks a good question:

http://skvidal.wordpress.com/2008/01/16/fixed-size-log-outputs/

Basically he wants to know if you can have syslog output a fixed log 
size, and the roll to another name? So say I only wanted 1 meg log 
files, and then after I reach 1 meg change the name too foobar.log.1 
or something.

I swear I thought this was possible with rsyslog, but I can't find 
anything in the docs. Is it possible? Was I hallucinating when I 
remembered this feature?

-- 
Scott Baker - Canby Telcom
RHCE - System Administrator - 503.266.8253
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog

From mic at npgx.com.au  Thu Jan 17 14:59:06 2008
From: mic at npgx.com.au (Michael Mansour)
Date: Thu, 17 Jan 2008 23:59:06 +1000
Subject: [rsyslog] Max Log Size
In-Reply-To: <478E45B5.70703@web-ster.com>
References: <478E45B5.70703@web-ster.com>
Message-ID: <20080117135738.M29519@npgx.com.au>

Hi Scott,

> Seth Vidal asks a good question:
> 
> http://skvidal.wordpress.com/2008/01/16/fixed-size-log-outputs/
> 
> Basically he wants to know if you can have syslog output a fixed log 
> size, and the roll to another name? So say I only wanted 1 meg log 
> files, and then after I reach 1 meg change the name too foobar.log.1 
> or something.
> 
> I swear I thought this was possible with rsyslog, but I can't find 
> anything in the docs. Is it possible? Was I hallucinating when I 
> remembered this feature?

Logrotate is able to rotate based on file size. What you could do (as a
workaround if rsyslog can't do it directly) is use inotify or a similar tool
to monitor the log file and then when it reaches the size you want call
logrotate to do the logrotation.

Regards,

Michael.

> -- 
> Scott Baker - Canby Telcom
> RHCE - System Administrator - 503.266.8253
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
------- End of Original Message -------


From mmeckelein at hq.adiscon.com  Thu Jan 17 17:37:00 2008
From: mmeckelein at hq.adiscon.com (Michael Meckelein)
Date: Thu, 17 Jan 2008 17:37:00 +0100
Subject: [rsyslog] Max Log Size
In-Reply-To: <20080117135738.M29519@npgx.com.au>
References: <478E45B5.70703@web-ster.com> <20080117135738.M29519@npgx.com.au>
Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308791@grfint2.intern.adiscon.com>

> > Seth Vidal asks a good question:
> >
> > http://skvidal.wordpress.com/2008/01/16/fixed-size-log-outputs/
> >
> > Basically he wants to know if you can have syslog output a fixed log
> > size, and the roll to another name? So say I only wanted 1 meg log
> > files, and then after I reach 1 meg change the name too foobar.log.1
> > or something.
> >
> > I swear I thought this was possible with rsyslog, but I can't find
> > anything in the docs. Is it possible? Was I hallucinating when I
> > remembered this feature?
> 
> Logrotate is able to rotate based on file size. What you could do (as
a
> workaround if rsyslog can't do it directly) is use inotify or a
similar
> tool
> to monitor the log file and then when it reaches the size you want
call
> logrotate to do the logrotation.

I just confirmed, it is possible with rsyslog using outchannel.

Use something like this in your rsyslog.conf: 

#start log rotation via outchannel
$outchannel
log_rotation,/var/log/log_rotation.log,52428800,/home/mm/./logrot

*.*     $log_rotation
#end log rotation

/home/mm/logrot is a simple script with a single command:
mv -f /var/log/log_rotation.log /var/log/log_rotation.log.1

In short: rsyslog always writes to log_rotation.log. If log_rotation.log
reaches 50 mb, the file is moved to log_rotation.log.1. With this, 100
mb are the maximum amount which is used for logging.

Best regards,
Michael

From mmeckelein at hq.adiscon.com  Fri Jan 18 15:43:56 2008
From: mmeckelein at hq.adiscon.com (Michael Meckelein)
Date: Fri, 18 Jan 2008 15:43:56 +0100
Subject: [rsyslog] Max Log Size
In-Reply-To: <20080117135738.M29519@npgx.com.au>
References: <478E45B5.70703@web-ster.com> <20080117135738.M29519@npgx.com.au>
Message-ID: <577465F99B41C842AAFBE9ED71E70ABA30879D@grfint2.intern.adiscon.com>

> Seth Vidal asks a good question:
> 
> http://skvidal.wordpress.com/2008/01/16/fixed-size-log-outputs/
> 
> Basically he wants to know if you can have syslog output a fixed log 
> size, and the roll to another name? So say I only wanted 1 meg log 
> files, and then after I reach 1 meg change the name too foobar.log.1 
> or something.
> 
> I swear I thought this was possible with rsyslog, but I can't find 
> anything in the docs. Is it possible? Was I hallucinating when I 
> remembered this feature?

Based on the discussion I have created a small article

Log rotation based on a fixed log size
http://www.rsyslog.com/module-Static_Docs-view-f-log_rotation_fix_size.h
tml.phtml

Best regards,
Michael

From skvidal at fedoraproject.org  Fri Jan 18 15:46:45 2008
From: skvidal at fedoraproject.org (seth vidal)
Date: Fri, 18 Jan 2008 09:46:45 -0500
Subject: [rsyslog] Max Log Size
In-Reply-To: <577465F99B41C842AAFBE9ED71E70ABA30879D@grfint2.intern.adiscon.com>
References: <478E45B5.70703@web-ster.com> <20080117135738.M29519@npgx.com.au>
	<577465F99B41C842AAFBE9ED71E70ABA30879D@grfint2.intern.adiscon.com>
Message-ID: <1200667605.15198.107.camel@cutter>


On Fri, 2008-01-18 at 15:43 +0100, Michael Meckelein wrote:
> > Seth Vidal asks a good question:
> > 
> > http://skvidal.wordpress.com/2008/01/16/fixed-size-log-outputs/
> > 
> > Basically he wants to know if you can have syslog output a fixed log 
> > size, and the roll to another name? So say I only wanted 1 meg log 
> > files, and then after I reach 1 meg change the name too foobar.log.1 
> > or something.
> > 
> > I swear I thought this was possible with rsyslog, but I can't find 
> > anything in the docs. Is it possible? Was I hallucinating when I 
> > remembered this feature?
> 
> Based on the discussion I have created a small article
> 
> Log rotation based on a fixed log size
> http://www.rsyslog.com/module-Static_Docs-view-f-log_rotation_fix_size.h
> tml.phtml
> 

Very nice. I appreciate y'all looking into it and acting on it so
quickly.

-sv



From friedl at hq.adiscon.com  Thu Jan 24 15:08:20 2008
From: friedl at hq.adiscon.com (Florian Riedl)
Date: Thu, 24 Jan 2008 15:08:20 +0100
Subject: [rsyslog] rsyslog 2.0.1 released
Message-ID: <577465F99B41C842AAFBE9ED71E70ABA3087D7@grfint2.intern.adiscon.com>

Hi all,

Rsyslog 2.0.1, a new stable branch version, has been released today. It
is a purely bug-fixing release. Most importantly, it fixes some
situations where rsyslogd could hang if there were problems writing to
output files or forwarding messages. Version 2.0.1 is a recommended
update for all stable branch users.

Please note that rsyslog 2.0.1 provides a stable environment without any
additional new features. Many new features are available in the v3
development branch.

Changelog:

http://www.rsyslog.com/Article165.phtml

Download:

http://www.rsyslog.com/Downloads-req-getit-lid-74.phtml


Best regards,

Florian

From friedl at hq.adiscon.com  Mon Jan 28 15:31:32 2008
From: friedl at hq.adiscon.com (Florian Riedl)
Date: Mon, 28 Jan 2008 15:31:32 +0100
Subject: [rsyslog] rsyslog 3.10.3 released
Message-ID: <577465F99B41C842AAFBE9ED71E70ABA30880F@grfint2.intern.adiscon.com>

Hello All,


we are very pleased to announce the immediate availability of rsyslog
3.10.3, a development branch release. This release is a major milestone:
it offers "disk-assisted" mode to the in-memory main message queue,
which essentially means that queued messages are automatically persisted
to disk if there is need to do so. This, for example, is the case when
the in-memory queue is full or rsyslogd needs to shut down without the
ability to complete processing of queued messages.

There are many use cases for this new mode. An actual sample -
high-volume database inserts - is briefly documented here:

http://www.rsyslog.com/module-Static_Docs-view-f-rsyslog_high_database_r
ate.html.phtml

The new engine now also comes with a full-featured, dynamic worker
thread pool. A maximum number of workers can be defined for the queue.
They are started and shut down automatically on an as-needed basis. This
is an important feature for multi-core machines, which can now be fully
utilized.

Even though powerful, rsyslog 3.10.3 is still an interim release: We
will immediately start with finally implementing store-and-forward mode
for each action (output destination).

As of the great magnitude of the changes, we do not yet recommend using
3.10.3 on production machines. However, we would deeply appreciate if it
is tried out and bugs be reported.

Changelog:

http://www.rsyslog.com/Article167.phtml

Download:

http://www.rsyslog.com/Downloads-req-getit-lid-75.phtml


As always, feedback is appreciated.

Florian Riedl

From rgerhards at hq.adiscon.com  Wed Jan 30 08:08:59 2008
From: rgerhards at hq.adiscon.com (Rainer Gerhards)
Date: Wed, 30 Jan 2008 08:08:59 +0100
Subject: [rsyslog] rsyslog/syslog-ng comparison
Message-ID: <577465F99B41C842AAFBE9ED71E70ABA30881F@grfint2.intern.adiscon.com>

Hi all,

I have added a rsyslog vs. syslog-ng feature comparison sheet to the doc
set:

http://www.rsyslog.com/doc-rsyslog_ng_comparison.html

I would appreciate if those familiar with syslog-ng's features (I am
not!) could have a look at it and tell me which bullet points are
missing. I try to get an as good comparison as possible and specifically
would like to see features listed that rsyslog is currently lacking.
Also, because I'll see if/when I can implement them. As such, I would
also appreciate your personal opinion on how important a missing feature
is.

Thanks,
Rainer

From mbiebl at gmail.com  Wed Jan 30 20:48:42 2008
From: mbiebl at gmail.com (Michael Biebl)
Date: Wed, 30 Jan 2008 20:48:42 +0100
Subject: [rsyslog] rsyslog/syslog-ng comparison
In-Reply-To: <577465F99B41C842AAFBE9ED71E70ABA30881F@grfint2.intern.adiscon.com>
References: <577465F99B41C842AAFBE9ED71E70ABA30881F@grfint2.intern.adiscon.com>
Message-ID: <aa76cdac0801301148o7937fd9blaabced35b5783230@mail.gmail.com>

2008/1/30, Rainer Gerhards <rgerhards at hq.adiscon.com>:
> Hi all,
>
> I have added a rsyslog vs. syslog-ng feature comparison sheet to the doc
> set:
>
> http://www.rsyslog.com/doc-rsyslog_ng_comparison.html
>
> I would appreciate if those familiar with syslog-ng's features (I am
> not!) could have a look at it and tell me which bullet points are
> missing. I try to get an as good comparison as possible and specifically
> would like to see features listed that rsyslog is currently lacking.
> Also, because I'll see if/when I can implement them. As such, I would
> also appreciate your personal opinion on how important a missing feature
> is.

The feature to include config files based on name, directory or wild
cards is missing in the list ;-)

Michael


-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

From rgerhards at hq.adiscon.com  Thu Jan 31 08:36:26 2008
From: rgerhards at hq.adiscon.com (Rainer Gerhards)
Date: Thu, 31 Jan 2008 08:36:26 +0100
Subject: [rsyslog] rsyslog/syslog-ng comparison
In-Reply-To: <aa76cdac0801301148o7937fd9blaabced35b5783230@mail.gmail.com>
References: <577465F99B41C842AAFBE9ED71E70ABA30881F@grfint2.intern.adiscon.com>
	<aa76cdac0801301148o7937fd9blaabced35b5783230@mail.gmail.com>
Message-ID: <577465F99B41C842AAFBE9ED71E70ABA30883A@grfint2.intern.adiscon.com>

> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of Michael Biebl
> Sent: Wednesday, January 30, 2008 8:49 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] rsyslog/syslog-ng comparison
> 
> 2008/1/30, Rainer Gerhards <rgerhards at hq.adiscon.com>:
> > Hi all,
> >
> > I have added a rsyslog vs. syslog-ng feature comparison sheet to the
> doc
> > set:
> >
> > http://www.rsyslog.com/doc-rsyslog_ng_comparison.html
> >
> > I would appreciate if those familiar with syslog-ng's features (I am
> > not!) could have a look at it and tell me which bullet points are
> > missing. I try to get an as good comparison as possible and
> specifically
> > would like to see features listed that rsyslog is currently lacking.
> > Also, because I'll see if/when I can implement them. As such, I
would
> > also appreciate your personal opinion on how important a missing
> feature
> > is.
> 
> The feature to include config files based on name, directory or wild
> cards is missing in the list ;-)

Could I miss this feature? ;) Well, I thought it is added by this bullet
point:

"config file includes, also full directory includes"

But that is probably a bit cryptic. Will see that I change the text.

And while we are at it: would a similar directive for $ModLoad make
sense (easy, but a bit doubtful from security perspective, malicious
users could just simply drop a Trojan on the well-known location and
know it'll get activated by rsyslogd on next system startup...).

Rainer

From rgerhards at hq.adiscon.com  Thu Jan 31 18:23:49 2008
From: rgerhards at hq.adiscon.com (Rainer Gerhards)
Date: Thu, 31 Jan 2008 18:23:49 +0100
Subject: [rsyslog] announcing rsyslog 3.11.0 - first open source disk
	buffering syslogd
Message-ID: <577465F99B41C842AAFBE9ED71E70ABA30883F@grfint2.intern.adiscon.com>

Hi all,

it is a great pleasure for me to do a fully buzzword-compliant
announcement for rsyslog 3.11.0, which is available immediately. This
release is a very important milestone: it is the first time ever that
the full, completely new queuing engine is in place.

Now rsyslog is the world's first-ever purely open-sourced syslogd
supporting disk based buffering individually for each log destination[*]
(called "action" in rsyslog speak). Besides, each action can now be
executed on its own thread. Together with the multi-threaded main worker
pool, rsyslog is more than ready for tomorrow's massively multi-core
machines. I think another "world's first" is the ability to
automatically discard low priority syslog messages under congestion
conditions.

The new engine provides, among others:

* reliable storage of messages while a destination is down
* persistence of message even when rsyslogd is shut down
* automatic retry of failed actions until they succeed,
  of course without any message loss
* unparalleled ability to handle message burst
* fully automatic worker thread pools
* slow actions (e.g. database writes) are de-coupled from
  quick local actions (e.g. file writes)
* rate-limited action processing
* flow control slows senders down when queues get full
* ability to discard less important messages in favor
  of higher important ones when the queue runs out of
  space 

All of this while using minimal system resources.

The system can be set up with few configuration commands, but provides
very in-depth commands to manipulate aspects like worker thread startup
and shutdown parameters, queue sizes, disk quotas, watermark algorithm
settings and many more (sometimes exotic) tweaking knobs.

Full details about the new system and its parameters can be found at:
   http://www.rsyslog.com/doc-queues.html

An actual use case, doing massive database inserts, is documented here:
   http://www.rsyslog.com/doc-rsyslog_high_database_rate.html

Rsyslog 3.11.0 is fresh off the "development press". While it is well
tested in lab, I expect that there are bugs in it, especially given the
magnitude of changes and the massively multithreaded processing flow. As
such, I do not yet advise to use it on important production machines.

I would, however, be very interested in feedback from the field,
including bug reports. My focus in the next weeks will be on making the
new engine rock-solid while at the same time introducing many new
features which are quite easy to build on top of the new engine (like
more advanced rate limiting algorithms, action execution-time windows
and more advanced ways to flow-control inputs). My hope is that within
two month or so we will have a very stable version suitable for
production use in the most demanding environments.

I hope that this announcement will motivate some people to try rsyslog
out and provide feedback to the project. Just be warned that I will not
be at my desk next week: I am taking my now hopefully deserved break
after a long time of hard coding. I thought to delay the announcement,
but have decided it is probably better to get some head start. So please
do not be disappointed if I do not reply immediately on comments posted.
For comments and questions, I recommend using either the mailing list or
the web forum at

http://www.rsyslog.com

I hope that rsyslog will be useful. Any feedback is appreciated.

Best regards,
Rainer Gerhards
Adiscon


[*] I know that syslog-ng does disk buffering, but it does not support
it in the open source edition.

From mbiebl at gmail.com  Thu Jan 31 22:55:42 2008
From: mbiebl at gmail.com (Michael Biebl)
Date: Thu, 31 Jan 2008 22:55:42 +0100
Subject: [rsyslog] announcing rsyslog 3.11.0 - first open source disk
	buffering syslogd
In-Reply-To: <577465F99B41C842AAFBE9ED71E70ABA30883F@grfint2.intern.adiscon.com>
References: <577465F99B41C842AAFBE9ED71E70ABA30883F@grfint2.intern.adiscon.com>
Message-ID: <aa76cdac0801311355y195a5497o7eff063fd568bd80@mail.gmail.com>

2008/1/31, Rainer Gerhards <rgerhards at hq.adiscon.com>:

> it is a great pleasure for me to do a fully buzzword-compliant
> announcement for rsyslog 3.11.0, which is available immediately. This
> release is a very important milestone: it is the first time ever that
> the full, completely new queuing engine is in place.

[..]

>
> I hope that rsyslog will be useful. Any feedback is appreciated.

Maybe it's just me, but I can't find the download link in the
announcement email nor on the website ;-)

Cheers,
Michael

-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

From rgerhards at hq.adiscon.com  Thu Jan 31 22:57:33 2008
From: rgerhards at hq.adiscon.com (Rainer Gerhards)
Date: Thu, 31 Jan 2008 22:57:33 +0100
Subject: [rsyslog] announcing rsyslog 3.11.0 - first open source
	diskbuffering syslogd
In-Reply-To: <aa76cdac0801311355y195a5497o7eff063fd568bd80@mail.gmail.com>
References: <577465F99B41C842AAFBE9ED71E70ABA30883F@grfint2.intern.adiscon.com>
	<aa76cdac0801311355y195a5497o7eff063fd568bd80@mail.gmail.com>
Message-ID: <577465F99B41C842AAFBE9ED71E70ABA308846@grfint2.intern.adiscon.com>

Its in the download section:

http://www.rsyslog.com/Downloads-index-req-viewdownload-cid-1-orderby-da
teD.phtml

Or for a short url via freshmeat:

http://freshmeat.net/projects/rsyslog/

Rainer 

> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com 
> [mailto:rsyslog-bounces at lists.adiscon.com] On Behalf Of Michael Biebl
> Sent: Thursday, January 31, 2008 10:56 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] announcing rsyslog 3.11.0 - first open 
> source diskbuffering syslogd
> 
> 2008/1/31, Rainer Gerhards <rgerhards at hq.adiscon.com>:
> 
> > it is a great pleasure for me to do a fully buzzword-compliant
> > announcement for rsyslog 3.11.0, which is available 
> immediately. This
> > release is a very important milestone: it is the first time 
> ever that
> > the full, completely new queuing engine is in place.
> 
> [..]
> 
> >
> > I hope that rsyslog will be useful. Any feedback is appreciated.
> 
> Maybe it's just me, but I can't find the download link in the
> announcement email nor on the website ;-)
> 
> Cheers,
> Michael
> 
> -- 
> Why is it that all of the instruments seeking intelligent life in the
> universe are pointed away from Earth?
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
>