| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
| |
The problem was that incomplete fiter evaluation was done *during the
shutdown phase*. This affected only the LAST batches being processed. No
problem existed during the regular run. Could usually only happen on
very busy systems, which were still busy during shutdown.
|
| | |
|
| |\
| |
| |
| |
| | |
Conflicts:
plugins/omudpspoof/omudpspoof.c
|
| | |\ |
|
| | | |
| | |
| | |
| | |
| | | |
it now truncates these message, but ensures they are sent. Note that
7.2.5+ will switch to fragmented UDP messages instead (up to 64K)
|
| | | | |
|
| | | | |
|
| | | | |
|
| |\| | |
|
| | |\|
| | |
| | |
| | |
| | | |
Conflicts:
ChangeLog
|
| | | | |
|
| | | |
| | |
| | |
| | | |
Use LT_LIB_M to find the math library which is needed for pow().
|
| | | |
| | |
| | |
| | | |
Building without pthreads support hasn't been support for a while.
|
| | | | |
|
| | | | |
|
| | | | |
|
| |\| |
| | |
| | |
| | |
| | | |
Conflicts:
tools/syslogd.c
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
This happened only on very high volume systems, if the same message was
being processed by two different actions. This was a regression caused
by the new config processor, which did no longer properly enable msg
locking in multithreaded cases. The bugfix is actually a refactoring of
the msg locking code - we no longer do unlocked operations, as the use
case for it has mostly gone away. It is potentially possible only at
very low-end systems, and there the small additional overhead of doing
the locking does not really hurt. Instead, the removal of that
capability can actually slightly improve performance in common cases,
as the code path is smaller and requires slightly less memory writes.
That probably outperforms the extra locking overhead (which in the
low-end case always happens in user space, without need for kernel
support as we can always directly aquire the lock - there is no
contention at all).
|
| | | |
| | |
| | |
| | | |
Released under ASL 2.0, permission given via email.
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
The "queue.xxx" parameter set was not supported, and legacy ruleset
config statements did not work (by intention). The fix introduces the
"queue.xxx" parameter set. It has some regression potential, but only
for the new functionality. Note that using that interface it is possible
to specify duplicate queue file names, which will cause trouble. This
will be solved in v7.3, because there is a too-large regression
potential for the v7.2 stable branch.
|
| | | |
| | |
| | |
| | |
| | | |
the changes do not affect actual code execution, just keep the
compile log clean.
|
| | | | |
|
| | | | |
|
| | | | |
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
registered
This lead to a "module not found" error message instead of
the to-be-expected "module does not support new style" error message.
That invalid error message could be quite misleading and actually stop
people from addressing the real problem (aka "go nuts" ;))
|
| | | | |
|
| | | | |
|
| |\| | |
|
| | | |
| | |
| | |
| | | |
which could also mean "never" or "not for a very long time".
|
| | | | |
|
| |\| | |
|
| | |\|
| | |
| | |
| | |
| | | |
Conflicts:
ChangeLog
|
| | | | |
|
| | | | |
|
| |\| | |
|
| | | |
| | |
| | |
| | |
| | | |
This is based on Marius Tomaschewski's set of patches, mostly
just applied manually (as I need to mangle with the merge).
|
| | |\|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Note: this was not a simple merge, I rather needed to adopt the v5 code to
the new v6 config handling. However, no v6 config format has been added yet
(this is the next step).
Conflicts:
plugins/imklog/imklog.c
plugins/imklog/imklog.h
|
| | | |
| | |
| | |
| | |
| | |
| | | |
... actually, they are microseconds. So the fractional part of the
timestamp was not properly formatted.
Thanks to Marius Tomaschwesky for the bug report and the patch idea.
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
When enabled, kernel message [timestamp] is converted for message time.
Default is to use receive time as in 5.8.x and before, because the clock
used to create the timestamp is not supposed to be as accurate as the
monotonic clock (depends on hardware and kernel) resulting in differences
between kernel and system messages which occurred at same time.
|
| | | |
| | |
| | |
| | |
| | | |
When enabled, the kernel [timestamp] remains at begin of
each message, even it is used for the message time too.
|
| | | | |
|
| | | |
| | |
| | |
| | | |
The bug fixes actually fixes a bug inside the *testbench* itself.
|
| | | | |
|
| | | | |
|
| | | |
| | |
| | |
| | |
| | |
| | | |
files
Unfortunately, this is often the case by default in many distros.
|
| | | | |
|
| | | | |
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Most importantly, the last patch for imfile contained a number
of glitches, which are fixed by this commit (a memory leak under
unusual conditions, partial message loss when rsyslog was
terminated in the interim & mixing file data to the wrong files
when multiple monitors were used [due to static variable]). The
commit is actually a re-write of the patch, based on its core
idea.
Also some other minor cleanup was done.
|
| | | | |
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
File lines that were incomplete (LF missing) *at the time imfile polled
the file* were partially discarded. That part of the line that was read
without the LF was discarded, and the rest of the line was submitted in
the next polling cycle. This is now changed so that the partial content
is saved until the complete line is read. Note that the patch affects
only read mode 0.
|
