Description of problem:
There are a few issues open against rsyslog in rhel7 that are fixed upstream in rsyslog v8. In addition, there are a number of features in rsyslog v8 that common logging would like to take advantage of, and help with migrations from fluentd to rsyslog. Perhaps it would be better to just rebase rsyslog to v8 for RHEL 7.3.
Peter Portante has been running rsyslog v8 ported to run on EL7 (centos + epel7). His build is based on the rsyslog v8 package in fedora 23. He is also adding a couple of plugins from upstream rsyslog.
However, there are some other dependencies (packages) that we will need to add to RHEL7 (or include privately in the rsyslogv8 package). Here is the result of building the fedora 24 package on rhel 7.3 candidate: https://brewweb.devel.redhat.com/taskinfo?taskID=10581812
We are missing the following packages:liblogging-stdlog-devel liblognorm-devel librabbitmq-devel
Here is the result of building Peter P.'s latest srpm on rhel 7.3 candidate: https://brewweb.devel.redhat.com/taskinfo?taskID=10581448
There are other dependencies in addition to the above: adiscon-librdkafka-devel grok grok-devel libgt-devel libksi-devel
These are due to the additional rsyslog v8 modules/plugins: mmfields pmciscoios mmutf8fix rsgtutil kafka ksi mmgrok
The following are available in EPEL7: librabbitmq-devel
Note that Peter P.'s copr repo has all of the dependencies not already in EPEL7, already ported to build on EL7: https://copr.fedorainfracloud.org/coprs/portante/rsyslog-v8.15/packages/
In addition, we will need the omamqp1 (and imamqp1, tbd) plugins available. These also have a dependency on qpid-proton-c which is in EPEL7. The current proposal is that the amqp1 plugins for rhel7 will include qpid-proton in a private location unavailable for use outside of the plugin (e.g. compiled and linked as a static library, or shared libraries in a private location).
Note that the rabbit module is problematic since librabbitmq is in EPEL7, so we can't just put it into RHEL7 without figuring out how to deprecate it in EPEL7. We could also include it in the rsyslog package and hide it as we are doing with qpid-proton.
The amqp1 plugins will be in a separate package, so we don't have to worry about those in the base package.
I've created copr repo with rsyslog8:
I've just tested rsyslog8
and here is difference between rsyslog7 and rsyslog8
(In reply to Radovan Sroka from comment #4)
> I've just tested rsyslog8
> and here is difference between rsyslog7 and rsyslog8
> RHEL7 Rsyslog7:
> RHEL8 Rsyslog8:
And please consider that one of the more recent changes for 8.16 and now required in 8.17 of rsyslog is the use of the libfastjson library .
The json-c library was found to be too buggy when rsyslog was used at scale in production. The libfastjson library fixes the problems with json-c.
I understand what json-c does and I will rebase rsyslog8 in copr repo but we must wait until new version of rsyslog will be released (2016-03-08), then I will rebase fedora repo too.
There is a leap year bug with v8.16+: http://lists.adiscon.net/pipermail/rsyslog/2016-March/042159.html
I filed https://bugzilla.redhat.com/show_bug.cgi?id=1313804
Peter Portante is now using rsyslog 8.17: https://copr.fedorainfracloud.org/coprs/portante/rsyslog-8.17/
I've ported the omamqp1 to this version (basically, just use upstream rsyslog 8.17 since it is included) and added support for the kubernetes work: https://github.com/richm/docker-rsyslog-collector/tree/rsyslog-v8/rpms
I've created a copr with the omamqp1 and mmkubernetes plugins: https://copr.fedorainfracloud.org/coprs/rmeggins/rsyslogv8-plugins/
With the current rsyslog container, if one needs to do granular log analysis, the file input module in polling mode gives only 10sec granulariy.
With rsyslog version 8.2 and above, inotify mode could be used with file
input module, which can feed the messages immediately into syslog.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.