------------------------------------------------------------------- Wed Jun 21 09:15:00 CEST 2017 - ndas@suse.de - dont not use cached timestamp for actionSuspend(bsc#1041210) [+0006-bugfix-failover-action-suspend-did-not-work-correctl.patch] ------------------------------------------------------------------- Mon Oct 6 12:38:35 UTC 2014 - mt@suse.de - Fixed remote PRI DoS vulnerability patch (CVE-2014-3683,bnc#899756) [* rsyslog-8.4.0-remote-PRI-DoS-fix-backport_CVE-2014-3634.patch] - Removed broken, unsupported and dropped by upstream zpipe utility from rsyslog-diag-tools package (bnc#890228) ------------------------------------------------------------------- Wed Sep 24 09:01:23 UTC 2014 - mt@suse.com - Remote syslog PRI DoS vulnerability fix (CVE-2014-3634,bnc#897262) [+ 0005-handle-invalid-PRI-values.CVE-2014-3634.bug897262.patch] ------------------------------------------------------------------- Wed Nov 21 15:36:12 UTC 2012 - mt@suse.com - imklog: added $klogParseKernelTimestamp option (default off), wich reverts to the 5.8.x behavior to use receive time for the kernel messages instead to try parse and convert the kernel timestamp, what is not reliable on some hardware (bnc#783967). - imklog: added $klogKeepKernelTimestamp option (default off), causing to not remove the kernel timestamp from the message after a successful conversion (bnc#783967). - imklog: fixed a conversion bug causing a <1sec incorrectness of the message time (bnc#783967). ------------------------------------------------------------------- Tue Nov 13 10:31:24 UTC 2012 - mt@suse.com - imuxsock: do not log EAGAIN in nonblocking recvfrom (bnc#734672) ------------------------------------------------------------------- Thu Oct 18 08:18:02 UTC 2012 - mt@suse.com - Updated to 5.10.1 [V5-stable] fixing the following issues: - bugfix: imuxsock and imklog truncated head of received message This happened only under some circumstances. Thanks to Marius Tomaschewski, Florian Piekert and Milan Bartos for their help in solving this issue (bnc#783177). - enable DNS resolution in imrelp Thanks to Apollon Oikonomopoulos for the patch - bugfix: invalid property name in property-filter could cause abort if action chaining (& operator) was used http://bugzilla.adiscon.com/show_bug.cgi?id=355 Thanks to pilou@gmx.com for the bug report - bugfix: remove invalid socket option call from imuxsock Thanks to Cristian Ionescu-Idbohrn and Jonny Törnbom - bugfix: fixed wrong bufferlength for snprintf in tcpflood.c when using the -f (dynafiles) option. - fixed issues in build system (related to cust1 dummy plugin) ------------------------------------------------------------------- Wed Sep 12 09:04:11 UTC 2012 - mt@suse.com - Updated to 5.10.0 [V5-stable] (fate#314421), the actual rsyslog v5-stable branch, that turns off rate limiting on unix socket by default, fixes privilege drop and provides new features: - added capability to specify substrings for field extraction mode - added configuration directives to customize queue light delay marks - permit size modifiers (k,m,g,...) in integer config parameters Thanks to Jo Rhett for the suggestion. - added configuration directive to disable octet-counted framing for imtcp, directive is $InputTCPServerSupportOctetCountedFraming for imptcp, directive is $InputPTCPServerSupportOctetCountedFraming - added capability to use a local interface IP address as fromhost-ip for locally originating messages. New directive $LocalHostIPIF - improved impstats subsystem, added many new counters - enhanced module loader to not rely on PATH_MAX - refactored imklog linux driver, now combined with BSD driver The Linux driver no longer supports outdated kernel symbol resolution, which was disabled by default for very long. Also overall cleanup, resulting in much smaller code. Linux and BSD are now covered by a single small driver. - $IMUXSockRateLimitInterval DEFAULT CHANGED, was 5, now 0 The new default turns off rate limiting. This was chosen as people experienced problems with rate-limiting activated by default. Now it needs an explicit opt-in by setting this parameter. Thanks to Chris Gaffney for suggesting to make it opt-in; thanks to many unnamed others who already had complained at the time Chris made the suggestion ;-) - imuxsock: added capability to "annotate" messages with "trusted information", which contains some properties obtained from the system and as such sure to not be faked. This is inspired by the similiar idea introduced in systemd. - removed dependency on gcrypt for recently-enough GnuTLS see: http://bugzilla.adiscon.com/show_bug.cgi?id=289 - added capability to emit config error location info for warnings otherwise, omusrmsg's warning about new config format was not accompanied by problem location. - added support for obtaining timestamp for kernel message from message If the kernel time-stamps messages, time is now take from that timestamp instead of the system time when the message was read. This provides much better accuracy. Thanks to Lennart Poettering for suggesting this feature and his help during implementation. - added support for obtaining timestamp from system for imuxsock This permits to read the time a message was submitted to the system log socket. Most importantly, this is provided in microsecond resolution. So we are able to obtain high precision timestampis even for messages that were - as is usual - not formatted with them. This also simplifies things in regard to local time calculation in chroot environments. Many thanks to Lennart Poettering for suggesting this feature, providing some guidance on implementing it and coordinating getting the necessary support into the Linux kernel. - imfile: added $InputFileMaxLinesAtOnce directive - enhanced imfile to support input batching - added capability for imtcp and imptcp to activate keep-alive packets at the socket layer. This has not been added to imttcp, as the latter is only an experimental module, and one which did not prove to be useful. reference: http://kb.monitorware.com/post20791.html - added support to control KEEPALIVE settings in imptcp this has not yet been added to imtcp, but could be done on request. - $ActionName is now also used for naming of queues in impstats as well as in the debug output - bugfix: do not open files with full privileges, if privs will be dropped This make the privilege drop code more bulletproof, but breaks Ubuntu's work-around for log files created by external programs with the wrong user and/or group. Note that it was long said that this "functionality" would break once we go for serious privilege drop code, so hopefully nobody still depends on it (and, if so, they lost...). - bugfix: pipes not opened in full priv mode when privs are to be dropped - better handling of queue i/o errors in disk queues. This is kind of a bugfix, but a very intrusive one, this it goes into the devel version first. Right now, "file not found" is handled and leads to the new emergency mode, in which disk action is stopped and the queue run in direct mode. An error message is emited if this happens. - added support for user-level PRI provided via systemd - added new config directive $InputTCPFlowControl to select if tcp received messages shall be flagged as light delayable or not. - enhanced omhdfs to support batching mode. This permits to increase performance, as we now call the HDFS API with much larger message sizes and far more infrequently ------------------------------------------------------------------- Mon Sep 10 13:03:31 UTC 2012 - mt@suse.com - Updated to 5.8.13 [V5-stable] (bnc#778769), a maintenance release in same version series, offering the following important fixes: Version 5.8.13 [V5-stable] 2012-08-22: - bugfix: DA queue could cause abort - bugfix: "last message repeated n times" message was missing hostname Thanks to Zdenek Salvet for finding this bug and to Bodik for reporting - bugfix "$PreserveFQDN on" was not honored in some modules Thanks to bodik for reporting this bug. - bugfix: randomized IP option header in omudpspoof caused problems closes: http://bugzilla.adiscon.com/show_bug.cgi?id=327 Thanks to Rick Brown for helping to test out the patch. - bugfix: potential abort if output plugin logged message during shutdown note that none of the rsyslog-provided plugins does this Thanks to bodik and Rohit Prasad for alerting us on this bug and analyzing it. fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=347 - bugfix: multiple main queues with same queue file name was not detected This lead to queue file corruption. While the root cause is a config error, it is a bug that this important and hard to find config error was not detected by rsyslog. Version 5.8.12 [V5-stable] 2012-06-06: - add small delay (50ms) after sending shutdown message There seem to be cases where the shutdown message is otherwise not processed, not even on an idle system. Thanks to Marcin for bringing this problem up. - support for resolving huge groups closes: http://bugzilla.adiscon.com/show_bug.cgi?id=310 Thanks to Alec Warner for the patch - bugfix: delayble source could block action queue, even if there was a disk queue associated with it. The root cause of this problem was that it makes no sense to delay messages once they arrive in the action queue - the "input" that is being held in that case is the main queue worker, what makes no sense. Thanks to Marcin for alerting us on this problem and providing instructions to reproduce it. - bugfix: disk queue was not persisted on shutdown, regression of fix to http://bugzilla.adiscon.com/show_bug.cgi?id=299 The new code also handles the case of shutdown of blocking light and full delayable sources somewhat smarter and permits, assuming sufficient timouts, to persist message up to the max queue capacity. Also some nits in debug instrumentation have been fixed. - bugfix/omudpspoof: problems, including abort, happend when run on multiple threads. Root cause is that libnet is not thread-safe. omudpspoof now guards libnet calls with their own mutex. - bugfix: if debug message could end up in log file when forking if rsyslog was set to auto-background (thus fork, the default) and debug mode to stdout was enabled, debug messages ended up in the first log file opened. Currently, stdout logging is completely disabled in forking mode (but writing to the debug log file is still possible). This is a change in behaviour, which is under review. If it causes problems to you, please let us know. Thanks to Tomas Heinrich for the patch. - bugfix/tcpflood: sending small test files did not work correctly - bugfix: potential hang due to mutex deadlock closes: http://bugzilla.adiscon.com/show_bug.cgi?id=316 Thanks to Andreas Piesk for reporting&analyzing this bug as well as providing patches and other help in resolving it. - bugfix: property PROCID empty instead of proper nilvalue if not present If it is not present, it must have the nilvalue "-" as of RFC5424 closes: http://bugzilla.adiscon.com/show_bug.cgi?id=332 Thanks to John N for reporting this issue. Version 5.8.11 [V5-stable] 2012-05-03: - bugfix: ommysql did not properly init/exit the mysql runtime library this could lead to segfaults. Triggering condition: multiple action instances using ommysql. Thanks to Tomas Heinrich for reporting this problem and providing an initial patch (which my solution is based on, I need to add more code to clean the mess up). - bugfix: rsyslog did not terminate when delayable inputs were blocked due to unvailable sources. Fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=299 Thanks to Marcin M for bringing up this problem and Andre Lorbach for helping to reproduce and fix it. - bugfix: active input in "light delay state" could block rsyslog termination, at least for prolonged period of time - bugfix: imptcp input name could not be set config directive was accepted, but had no effect - bugfix: assigned ruleset was lost when using disk queues This looked quite hard to diagnose for disk-assisted queues, as the pure memory part worked well, but ruleset info was lost for messages stored inside the disk queue. - bugfix: hostname was not requeried on HUP Thanks to Per Jessen for reporting this bug and Marius Tomaschewski for his help in testing the fix. - bugfix: inside queue.c, some thread cancel states were not correctly reset. While this is a bug, we assume it did have no practical effect because the reset as it was done was set to the state the code actually had at this point. But better fix this... Version 5.8.10 [V5-stable] 2012-04-05: - bugfix: segfault on startup if $actionqueuefilename was missing for disk queue config Thanks to Tomas Heinrich for the patch. - bugfix: segfault if disk-queue was started up with old queue file Thanks to Tomas Heinrich for the patch. - bugfix: memory leak in array passing output module mode Version 5.8.9 [V5-stable] 2012-03-15: - added tool to recover disk queue if .qi file is missing (recover_qi.pl) Thanks to Kaiwang Chen for contributing this tool - bugfix: stopped DA queue was never processed after a restart due to a regression from statistics module - added better doc for statsobj interface Thanks to Kaiwang Chen for his suggestions and analysis in regard to the stats subsystem. Version 5.8.8 [V5-stable] 2012-03-05: - bugfix: omprog made rsyslog abort on startup if not binary to execute was configured - bugfix: imklog invalidly computed facility and severity closes: http://bugzilla.adiscon.com/show_bug.cgi?id=313 ------------------------------------------------------------------- Mon Jan 30 11:30:38 UTC 2012 - mt@suse.com - Updated to 5.8.7 [V5-stable] (bnc#744055), a maintenance release offering the following bug fixes: - bugfix: instabilities when using RFC5424 header fields Thanks to Kaiwang Chen for the patch - bugfix: imuxsock did truncate part of received message if it did not contain a proper date. The truncation occured because we removed that part of the messages that was expected to be the date. closes: http://bugzilla.adiscon.com/show_bug.cgi?id=295 - bugfix: potential abort after reading invalid X.509 certificate closes: http://bugzilla.adiscon.com/show_bug.cgi?id=290 Thanks to Tomas Heinrich for the patch - bugfix: stats counter were not properly initialized on creation - FQDN hostname for multihomed host was not always set to the correct name if multiple aliases existed. Thanks to Tomas Heinreich for the patch. ------------------------------------------------------------------- Tue Jan 3 12:49:02 UTC 2012 - mt@suse.com - Updated to 5.8.6 [V5-stable], a maintenance release offering the following bug fixes: - bugfix: missing whitespace after property-based filter was not detected - bugfix: $OMFileFlushInterval period was doubled – now using correct value - bugfix: ActionQueue could malfunction due to index error Thanks to Vlad Grigorescu for the patch - bugfix: $ActionExecOnlyOnce interval did not work properly Thanks to Tomas Heinrich for the patch - bugfix: race condition when extracting program name, APPNAME, structured data and PROCID (RFC5424 fields) could lead to invalid characters e.g. in dynamic file names or during forwarding (general malfunction of these fields in templates, mostly under heavy load) - bugfix: imuxsock did no longer ignore message-provided timestamp, if so configured (the *default*). Lead to no longer sub-second timestamps. closes: http://bugzilla.adiscon.com/show_bug.cgi?id=281 - bugfix: omfile returns fatal error code for things that go really wrong previously, RS_RET_RESUME was returned, which lead to a loop inside the rule engine as omfile could not really recover. - bugfix: imfile did invalid system call under some circumstances when a file that was to be monitored did not exist BUT the state file actually existed. Mostly a cosmetic issue. Root cause was incomplete error checking in stream.c; so patch may affect other code areas. - bugfix: rsyslogd -v always said 64 atomics were not present Thanks to mono_matsuko for the patch ------------------------------------------------------------------- Wed Sep 7 13:08:39 UTC 2011 - mt@suse.com - Updated to 5.8.5 [V5-stable]: - bugfix/security: off-by-two bug in legacy syslog parser, CVE-2011-3200 bnc#714658 - bugfix: mark message processing did not work correctly - bugfix: potential hang condition during tag emulation - bugfix: too-early string termination during tag emulation - bugfix: The NUL-Byte for the syslogtag was not copied in MsgDup (msg.c) - bugfix: fixed incorrect state handling for Discard Action (transactions) Note: This caused all messages in a batch to be set to COMMITTED, even if they were discarded. ------------------------------------------------------------------- Mon Aug 29 16:19:40 UTC 2011 - mt@suse.com - Applied patch for 1/2 byte buffer overflow while parsing legacy syslog messages that may cause a crash (CVE-2011-3200,bnc#714658). ------------------------------------------------------------------- Tue Aug 23 10:44:44 UTC 2011 - mt@suse.com - Updated to 5.8.4 [V5-stable] (bnc#701282) a maintenance release, fixing potential misadressing in property replacer and a MSGID corruption in RFC5424 parser under some circumstances (closes http://bugzilla.adiscon.com/show_bug.cgi?id=275). - Removed obsolete rsyslog-5.8.0-memcpy.patch - Merged cleanup from factory: - Added libgcrypt-devel build require needed by newer gnutls. - Dropped modules imtemplate and omtemplate (base templates for development of custom modules), enabled impstats, pmcisconames, pmaixforwardedfrom, pmsnare, pmrfc3164sd, omruleset, mmsnmptrapd which dont pull extra dependencies. - Updated *.emerg rule in the default config to new syntax using :omusrmsg:* action instead of just * and :omfile:$channel instead of just $channel. Reqested by upstream. ------------------------------------------------------------------- Tue Jun 21 13:50:42 UTC 2011 - mt@suse.de - Updated to 5.8.2 [V5-stable] (bnc#701282) a maintenance release, containing only stability fixes: - bugfix: problems in failover action handling closes: http://bugzilla.adiscon.com/show_bug.cgi?id=270 closes: http://bugzilla.adiscon.com/show_bug.cgi?id=254 - bugfix: mutex was invalidly left unlocked during action processing At least one case where this can occur is during thread shutdown, which may be initiated by lower activity. In most cases, this is quite unlikely to happen. However, if it does, data structures may be corrupted which could lead to fatal failure and segfault. I detected this via a testbench test, not a user report. But I assume that some users may have had unreproducable aborts that were cause by this bug. - bugfix: memory leak in imtcp & subsystems under some circumstances This leak is tied to error conditions which lead to incorrect cleanup of some data structures. [backport from v6] - bugfix/improvement:$WorkDirectory now gracefully handles trailing slashes ------------------------------------------------------------------- Fri May 27 07:53:38 UTC 2011 - mt@suse.de - Removed touch of obsolete /var/log/boot.log from spec post. ------------------------------------------------------------------- Fri May 20 10:39:12 UTC 2011 - mt@suse.de - Enabled relp support for SLE-11-SP2 (fate#309847). ------------------------------------------------------------------- Thu May 19 15:43:28 UTC 2011 - mrueckert@suse.de - update to 5.8.1 - bugfix: invalid processing in QUEUE_FULL condition If the the multi-submit interface was used and a QUEUE_FULL condition occured, the failed message was properly destructed. However, the rest of the input batch, if it existed, was not processed. So this lead to potential loss of messages and a memory leak. The potential loss of messages was IMHO minor, because they would have been dropped in most cases due to the queue remaining full, but very few lucky ones from the batch may have made it. Anyhow, this has now been changed so that the rest of the batch is properly tried to be enqueued and, if not possible, destructed. - new module mmsnmptrapd, a sample message modification module This can be useful to reformat snmptrapd messages and also serves as a sample for how to write message modification modules using the output module interface. Note that we introduced this new functionality directly into the stable release, as it does not modify the core and as such cannot have any side-effects if it is not used (and thus the risk is solely on users requiring that functionality). - bugfix: rate-limiting inside imuxsock did not work 100% correct reason was that a global config variable was invalidly accessed where a listener variable should have been used. Also performance-improved the case when rate limiting is turned off (this is a very unintrusive change, thus done directly to the stable version). - bugfix: $myhostname not available in RainerScript (and no error message) closes: http://bugzilla.adiscon.com/show_bug.cgi?id=233 - bugfix: memory and file descriptor leak in stream processing Leaks could occur under some circumstances if the file stream handler errored out during the open call. Among others, this could cause very big memory leaks if there were a problem with unreadable disk queue files. In regard to the memory leak, this closes: http://bugzilla.adiscon.com/show_bug.cgi?id=256 - bugfix: doc for impstats had wrong config statements also, config statements were named a bit inconsistent, resolved that problem by introducing an alias and only documenting the consistent statements Thanks to Marcin for bringing up this problem. - bugfix: IPv6-address could not be specified in omrelp this was due to improper parsing of ":" closes: http://bugzilla.adiscon.com/show_bug.cgi?id=250 - bugfix: TCP connection invalidly aborted when messages needed to be discarded (due to QUEUE_FULL or similar problem) - bugfix: $LocalHostName was not honored under all circumstances closes: http://bugzilla.adiscon.com/show_bug.cgi?id=258 - bugfix(minor): improper template function call in syslogd.c ------------------------------------------------------------------- Thu May 5 07:59:11 UTC 2011 - mt@suse.de - Update to 5.8.0 (v5-stable branch) providing several new features (fate#309847) as: - support for TLS encrypted TCP logging - reliable remote logging with RELP - compressed sending and receiving - failover log destinations For a complete list of changes and new features, see ChangeLog file and also documentation provided in the rsyslog-doc package. - Applied a fix for a memcpy overflow while processing allowed sender rules in the config that resolve to IPv4-mapped-on-IPv6 addresses. - Improved default config file, added more examples. ------------------------------------------------------------------- Mon Apr 4 18:18:34 UTC 2011 - mt@suse.de - Backported plain tcp syslog reliability improvement by doing a connection check before sending. Credits to Martin Schuette for providing the idea. Details are available at http://blog.gerhards.net/2008/06/reliable-plain-tcp-syslog-once-again.html The new "$ActionSendResendLastMsgOnReconnect on" option (default is off) can be used to resend the last message while a connection lost in costs of an increased probability of message duplication. (bnc#682012). ------------------------------------------------------------------- Wed Aug 18 13:57:42 UTC 2010 - mt@suse.de - Extracted fix from git to acquire a msg mutex before decreasing msg reference counter. The bug may cause that rsyslog dies with sigabrt in free (bnc#632290). ------------------------------------------------------------------- Mon Dec 15 14:51:08 CET 2008 - mt@suse.de - Security fix to honor $AllowedSender settings (bnc#457273). - Security fix [DoS] from 3.20.2 to emit a discard message every minute only (when DisallowWarning enabled) instead of every time; this prevernts an attacker can fill the disk (bnc#457273). ------------------------------------------------------------------- Wed Sep 10 15:11:05 CEST 2008 - schwab@suse.de - Run autoreconf. ------------------------------------------------------------------- Tue Sep 9 16:16:14 CEST 2008 - mt@suse.de - Enabled mail, imfile and imtemplate modules - Enabled snmp module, packaged as rsyslog-module-snmp - Added patch to support multiple module directories, in our case /lib[64]/rsyslog:/usr/lib[64]/rsyslog ------------------------------------------------------------------- Thu Sep 4 15:15:14 CEST 2008 - mt@suse.de - initial rsyslog 3.18.3 package