Bug 1313490 (rsyslog-rhel74-rebase)
| Summary: | rebase to rsyslog v8 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Rich Megginson <rmeggins> |
| Component: | rsyslog | Assignee: | Radovan Sroka <rsroka> |
| Status: | CLOSED ERRATA | QA Contact: | Stefan Dordevic <sdordevi> |
| Severity: | medium | Docs Contact: | Vladimír Slávik <vslavik> |
| Priority: | medium | ||
| Version: | 7.3 | CC: | apmukher, brubisch, dbodnarc, dkopecek, erinn.looneytriggs, ffotorel, fvzwieten, kbost, ksrot, lvlcek, martin, mdshaikh, mgrepl, mmezynsk, mnapolis, nparmar, pasik, pportant, pvrabec, redhat-bugzilla, roysjosh, rrajaram, rsawhill, rsroka, sanujan, szidek |
| Target Milestone: | rc | Keywords: | Rebase, Triaged |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | rsyslog-8.24.0-6.el7 | Doc Type: | Rebase: Bug Fixes and Enhancements |
| Doc Text: |
*rsyslog* rebased to version 8.24.0
The *rsyslog* utility has been rebased to upstream version 8.24.0, which includes numerous enhancements, new features and bug fixes. Notable improvements include:
* A new core engine has been implemented, offering faster message processing.
* Speed and stability when handling data in the JSON format have been improved.
* The RainerScript configuration format has been selected as default and improved with more options.
* A new *mmexternal* module for manipulation of messages inside *rsyslog* using external applications has been added.
* The *omprog* module has received improvements for better communication with external binaries.
* Modules *imrelp* and *omrelp* now support encrypted transmission using the TLS protocol.
* The *imuxsock* module now supports rule sets for individual sockets, which override the global rule set.
* When the *imuxsock* module is used, rate limiting messages now include PID of the process that causes the rate limiting.
* The TCP server error messages now include the IP address of the remote host.
* The *imjournal* module no longer stops receiving logs after switching to the persistent *journald* configuration.
* Logging to the runtime journal no longer completely stops after a reboot when the machine's clock was set to an earlier time.
* Previously, when the *logrotate* utility with "copytruncate" option was rotating a log file, the *imfile* module might not have read all of the log messages from the file being rotated. As a consequence, these log messages were lost. The *imfile* module has been extended to handle this situation. As a consquence, messages are no longer lost when *logrotate* "copytruncate" is used on log files.
Customers using custom modules are advised to update their modules for the current rsyslog version.
See also the Deprecated Functionality chapter for information about deprecated *rsyslog* options.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-08-01 09:53:51 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1395145, 1399555, 1399562, 1399569, 1399652, 1400594, 1401870, 1403815, 1403831, 1403858, 1403874, 1403888, 1403907, 1410508, 1422395, 1422414, 1431615, 1433913 | ||
| Bug Blocks: | 1053641, 1056548, 1133687, 1174345, 1326216, 1369462, 1377248, 1404805, 1410630, 1411695, 1411798, 1412395 | ||
|
Description
Rich Megginson
2016-03-01 16:59:35 UTC
In addition, we will need the omamqp1 (and imamqp1, tbd) plugins available. These also have a dependency on qpid-proton-c which is in EPEL7. The current proposal is that the amqp1 plugins for rhel7 will include qpid-proton in a private location unavailable for use outside of the plugin (e.g. compiled and linked as a static library, or shared libraries in a private location). Note that the rabbit module is problematic since librabbitmq is in EPEL7, so we can't just put it into RHEL7 without figuring out how to deprecate it in EPEL7. We could also include it in the rsyslog package and hide it as we are doing with qpid-proton. The amqp1 plugins will be in a separate package, so we don't have to worry about those in the base package. Hi, I've created copr repo with rsyslog8: https://copr.devel.redhat.com/coprs/rsroka/rsyslog8/ Hi, I've just tested rsyslog8 and here is difference between rsyslog7 and rsyslog8 RHEL7 Rsyslog7: https://beaker.engineering.redhat.com/jobs/1244931 RHEL8 Rsyslog8: https://beaker.engineering.redhat.com/jobs/1242551 (In reply to Radovan Sroka from comment #4) > Hi, > > I've just tested rsyslog8 > and here is difference between rsyslog7 and rsyslog8 > > RHEL7 Rsyslog7: > https://beaker.engineering.redhat.com/jobs/1244931 > > RHEL8 Rsyslog8: > https://beaker.engineering.redhat.com/jobs/1242551 RHEL7 --^ Sorry. And please consider that one of the more recent changes for 8.16 and now required in 8.17 of rsyslog is the use of the libfastjson library [1]. The json-c library was found to be too buggy when rsyslog was used at scale in production. The libfastjson library fixes the problems with json-c. [1] https://github.com/rsyslog/libfastjson Hi Peter, I understand what json-c does and I will rebase rsyslog8 in copr repo but we must wait until new version of rsyslog will be released (2016-03-08), then I will rebase fedora repo too. There is a leap year bug with v8.16+: http://lists.adiscon.net/pipermail/rsyslog/2016-March/042159.html Peter Portante is now using rsyslog 8.17: https://copr.fedorainfracloud.org/coprs/portante/rsyslog-8.17/ I've ported the omamqp1 to this version (basically, just use upstream rsyslog 8.17 since it is included) and added support for the kubernetes work: https://github.com/richm/docker-rsyslog-collector/tree/rsyslog-v8/rpms I've created a copr with the omamqp1 and mmkubernetes plugins: https://copr.fedorainfracloud.org/coprs/rmeggins/rsyslogv8-plugins/ With the current rsyslog container, if one needs to do granular log analysis, the file input module in polling mode gives only 10sec granulariy. With rsyslog version 8.2 and above, inotify mode could be used with file input module, which can feed the messages immediately into syslog. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2306 |