summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| * | add some better debug information to impstatsRainer Gerhards2012-12-181-0/+2
| | |
| * | doc: document v7 omudpspoof config parametersRainer Gerhards2012-12-171-26/+60
| | |
| * | omudpspoof: add support for new config systemRainer Gerhards2012-12-172-2/+98
| | |
| * | doc: mention omudpspoof message size limitsRainer Gerhards2012-12-171-0/+5
| | |
| * | omudpspoof: add support for packets larger than 1472 bytesRainer Gerhards2012-12-173-16/+87
| | | | | | | | | | | | | | | | | | On Ethernet, they need to be transmitted in multiple fragments. While it is known that fragmentation can cause issues, it is the best choice to be made in that case. Also improved debug output.
* | | Merge branch 'v7-stable'Rainer Gerhards2012-12-172-9/+23
|\ \ \ | | |/ | |/|
| * | Merge branch 'v6-stable' into v7-stableRainer Gerhards2012-12-172-0/+9
| |\ \ | | |/ | |/| | | | | | | Conflicts: plugins/omudpspoof/omudpspoof.c
| | * Merge branch 'v5-stable' into v6-stableRainer Gerhards2012-12-172-1/+10
| | |\
| | | * bugfix[kind of]: omudpspoof discarded messages >1472 bytes (MTU size)Rainer Gerhards2012-12-172-1/+10
| | | | | | | | | | | | | | | | | | | | it now truncates these message, but ensures they are sent. Note that 7.2.5+ will switch to fragmented UDP messages instead (up to 64K)
| * | | omudpspoof: better debug outputRainer Gerhards2012-12-171-10/+14
| | | |
| * | | add extra debug info to tackle omudpspoof problemRainer Gerhards2012-12-171-0/+1
| | | |
* | | | bugfix: very minimal bugfix in imfileRainer Gerhards2012-12-141-0/+2
| | | | | | | | | | | | | | | | | | | | not really relevant for production, a few KB were lost during initialization phase if no state file was present
* | | | bugfix: small, mostly static memory leak in imtcpRainer Gerhards2012-12-141-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | This had no practical effect, a handful of bytes was lost at most, no matter how many messages were processed (leak in config processor).
* | | | bugfix/testbench: tls tests failed in make distcheck due to missing filesRainer Gerhards2012-12-142-1/+4
| | | |
* | | | fix some compile problems on some platformsRainer Gerhards2012-12-142-1/+1
| | | |
* | | | ommysql: addd batching/transaction supportUlrike Gerhards2012-12-142-4/+32
| | | |
* | | | minor cleanupRainer Gerhards2012-12-143-3/+13
| | | |
* | | | Merge branch 'master-optimize-facilitext'Rainer Gerhards2012-12-143-25/+371
|\ \ \ \
| * | | | script optimizer: support textual severities in compare operations as wellRainer Gerhards2012-12-111-0/+17
| | | | |
| * | | | script optimizer: support numerical facilities in compare operations as wellRainer Gerhards2012-12-111-5/+58
| | | | |
| * | | | script optimizer: severity lt/le/gt/ge to prifilt()Rainer Gerhards2012-12-111-16/+46
| | | | |
| * | | | script optimizer: severity eq/ne to prifilt()Rainer Gerhards2012-12-111-5/+37
| | | | |
| * | | | bugfix: optimizer stopped prematurely on some operationsRainer Gerhards2012-12-111-0/+11
| | | | |
| * | | | script optimizer: optimize and/or on PRI filtersRainer Gerhards2012-12-111-0/+37
| | | | |
| * | | | script optimizer: support NOT pri matchesRainer Gerhards2012-12-111-4/+42
| | | | |
| * | | | enhance optimizer: detect eq-comparison for syslog facilityRainer Gerhards2012-12-113-20/+148
| | | | | | | | | | | | | | | | | | | | ... and replace it with a (much faster) prifilt() call
* | | | | Merge branch 'v7-stable'Rainer Gerhards2012-12-134-23/+19
|\ \ \ \ \ | | |/ / / | |/| | |
| * | | | doc: mention recent patches in ChangeLogRainer Gerhards2012-12-131-0/+7
| | | | |
| * | | | Merge branch 'v6-stable' into v7-stableRainer Gerhards2012-12-132-1/+5
| |\ \ \ \ | | | |/ / | | |/| |
| | * | | Merge branch 'v5-stable' into v6-stableRainer Gerhards2012-12-132-1/+5
| | |\ \ \ | | | | |/ | | | |/| | | | | | | | | | | Conflicts: ChangeLog
| | | * | bugfix: invalid DST handling under SolarisScott Severtson2012-12-132-1/+3
| | | | |
| * | | | build: link omelasticsearch against -lmMichael Biebl2012-12-132-1/+2
| | | | | | | | | | | | | | | | | | | | Use LT_LIB_M to find the math library which is needed for pow().
| * | | | build: drop obsolete --enable-pthreads configure switchMichael Biebl2012-12-131-18/+2
| | | | | | | | | | | | | | | | | | | | Building without pthreads support hasn't been support for a while.
| * | | | build: fix uuid configure checkMichael Biebl2012-12-131-3/+3
| | | | |
* | | | | Merge branch 'v7-stable'Rainer Gerhards2012-12-071-1/+1
|\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: configure.ac doc/manual.html
| * | | | prepare for 7.2.4v7.2.4Rainer Gerhards2012-12-073-3/+3
| | | | |
* | | | | Merge branch 'v7-stable'Rainer Gerhards2012-12-071-0/+15
|\| | | |
| * | | | doc: mention important up-merged patch in ChangeLogRainer Gerhards2012-12-071-0/+15
| | | | |
* | | | | cosmetic: give testbench test a bit more time for slow machinesRainer Gerhards2012-12-061-0/+1
| | | | |
* | | | | doc: mention msg obj changes in ChangeLogRainer Gerhards2012-12-061-1/+15
| | | | |
* | | | | Merge branch 'v7-stable-newmsglock' into master-newmsglockRainer Gerhards2012-12-0617-238/+300
|\| | | | | |_|_|/ |/| | | | | | | | | | | | | | | | | | | Conflicts: runtime/msg.c runtime/queue.c tools/syslogd.c
| * | | Merge branch 'v6-stable-newmsglock' into v7-stable-newmsglockRainer Gerhards2012-12-065-167/+24
| |\| | | | | | | | | | | | | | | | | | Conflicts: tools/syslogd.c
| | * | bugfix: some message properties could be garbled due to race conditionRainer Gerhards2012-12-066-169/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This happened only on very high volume systems, if the same message was being processed by two different actions. This was a regression caused by the new config processor, which did no longer properly enable msg locking in multithreaded cases. The bugfix is actually a refactoring of the msg locking code - we no longer do unlocked operations, as the use case for it has mostly gone away. It is potentially possible only at very low-end systems, and there the small additional overhead of doing the locking does not really hurt. Instead, the removal of that capability can actually slightly improve performance in common cases, as the code path is smaller and requires slightly less memory writes. That probably outperforms the extra locking overhead (which in the low-end case always happens in user space, without need for kernel support as we can always directly aquire the lock - there is no contention at all).
| * | | permit RFC3339 timestamp in local log socket messagesSebastien Ponce2012-12-032-3/+9
| | | | | | | | | | | | | | | | Released under ASL 2.0, permission given via email.
| * | | fix missing functionality: ruleset(){} could not specify ruleset queueRainer Gerhards2012-11-309-63/+151
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The "queue.xxx" parameter set was not supported, and legacy ruleset config statements did not work (by intention). The fix introduces the "queue.xxx" parameter set. It has some regression potential, but only for the new functionality. Note that using that interface it is possible to specify duplicate queue file names, which will cause trouble. This will be solved in v7.3, because there is a too-large regression potential for the v7.2 stable branch.
| * | | silence compiler warningsRainer Gerhards2012-11-305-8/+29
| | | | | | | | | | | | | | | | | | | | the changes do not affect actual code execution, just keep the compile log clean.
| * | | fix display problem with some date-format template optionsRainer Gerhards2012-11-291-1/+7
| | | |
* | | | bugfix[minor]: invalid error code when mmnormalize could not access rulebaseRainer Gerhards2012-11-303-3/+6
| | | |
* | | | cleanupRainer Gerhards2012-11-301-1/+0
| | | |
* | | | bugfix: segfault on imuxsock startup if system log socket is used and no ↵Rainer Gerhards2012-11-292-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | ratelimiting supported. Happens only during initial config read phase, once this is over, everything works stable.