Hide Forgot
Description of problem: There are a few issues open against rsyslog in rhel7 that are fixed upstream in rsyslog v8. In addition, there are a number of features in rsyslog v8 that common logging would like to take advantage of, and help with migrations from fluentd to rsyslog. Perhaps it would be better to just rebase rsyslog to v8 for RHEL 7.3. Peter Portante has been running rsyslog v8 ported to run on EL7 (centos + epel7). His build is based on the rsyslog v8 package in fedora 23. He is also adding a couple of plugins from upstream rsyslog. However, there are some other dependencies (packages) that we will need to add to RHEL7 (or include privately in the rsyslogv8 package). Here is the result of building the fedora 24 package on rhel 7.3 candidate: https://brewweb.devel.redhat.com/taskinfo?taskID=10581812 We are missing the following packages:liblogging-stdlog-devel liblognorm-devel librabbitmq-devel Here is the result of building Peter P.'s latest srpm on rhel 7.3 candidate: https://brewweb.devel.redhat.com/taskinfo?taskID=10581448 There are other dependencies in addition to the above: adiscon-librdkafka-devel grok grok-devel libgt-devel libksi-devel These are due to the additional rsyslog v8 modules/plugins: mmfields pmciscoios mmutf8fix rsgtutil kafka ksi mmgrok The following are available in EPEL7: librabbitmq-devel Note that Peter P.'s copr repo has all of the dependencies not already in EPEL7, already ported to build on EL7: https://copr.fedorainfracloud.org/coprs/portante/rsyslog-v8.15/packages/
In addition, we will need the omamqp1 (and imamqp1, tbd) plugins available. These also have a dependency on qpid-proton-c which is in EPEL7. The current proposal is that the amqp1 plugins for rhel7 will include qpid-proton in a private location unavailable for use outside of the plugin (e.g. compiled and linked as a static library, or shared libraries in a private location). Note that the rabbit module is problematic since librabbitmq is in EPEL7, so we can't just put it into RHEL7 without figuring out how to deprecate it in EPEL7. We could also include it in the rsyslog package and hide it as we are doing with qpid-proton.
The amqp1 plugins will be in a separate package, so we don't have to worry about those in the base package.
Hi, I've created copr repo with rsyslog8: https://copr.devel.redhat.com/coprs/rsroka/rsyslog8/
Hi, I've just tested rsyslog8 and here is difference between rsyslog7 and rsyslog8 RHEL7 Rsyslog7: https://beaker.engineering.redhat.com/jobs/1244931 RHEL8 Rsyslog8: https://beaker.engineering.redhat.com/jobs/1242551
(In reply to Radovan Sroka from comment #4) > Hi, > > I've just tested rsyslog8 > and here is difference between rsyslog7 and rsyslog8 > > RHEL7 Rsyslog7: > https://beaker.engineering.redhat.com/jobs/1244931 > > RHEL8 Rsyslog8: > https://beaker.engineering.redhat.com/jobs/1242551 RHEL7 --^ Sorry.
And please consider that one of the more recent changes for 8.16 and now required in 8.17 of rsyslog is the use of the libfastjson library [1]. The json-c library was found to be too buggy when rsyslog was used at scale in production. The libfastjson library fixes the problems with json-c. [1] https://github.com/rsyslog/libfastjson
Hi Peter, I understand what json-c does and I will rebase rsyslog8 in copr repo but we must wait until new version of rsyslog will be released (2016-03-08), then I will rebase fedora repo too.
There is a leap year bug with v8.16+: http://lists.adiscon.net/pipermail/rsyslog/2016-March/042159.html
I filed https://bugzilla.redhat.com/show_bug.cgi?id=1313804
Peter Portante is now using rsyslog 8.17: https://copr.fedorainfracloud.org/coprs/portante/rsyslog-8.17/ I've ported the omamqp1 to this version (basically, just use upstream rsyslog 8.17 since it is included) and added support for the kubernetes work: https://github.com/richm/docker-rsyslog-collector/tree/rsyslog-v8/rpms I've created a copr with the omamqp1 and mmkubernetes plugins: https://copr.fedorainfracloud.org/coprs/rmeggins/rsyslogv8-plugins/
With the current rsyslog container, if one needs to do granular log analysis, the file input module in polling mode gives only 10sec granulariy. With rsyslog version 8.2 and above, inotify mode could be used with file input module, which can feed the messages immediately into syslog.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2306