32874cce33
- backport major bug fixes from development branch fixing various crashes and message loss * 0001-Merge-pull-request-5437-from-HofiOne-fix-ack-tracker.patch * 0002-Merge-pull-request-5441-from-HofiOne-fix-mem-leaks.patch * 0003-Merge-pull-request-5445-from-beni-atlnz-log-writer-c.patch * 0004-Merge-pull-request-5447-from-therandomstring-s3-fix-.patch
peter czanik2025-09-11 11:49:26 +00:00
046f43f4c5
Accepting request 1293850 from Base:System
Ana Guerrero2025-07-17 15:18:40 +00:00
885aecebf5
- update to 4.9.0 * added modules for clickhouse and pubsub destination * added configuration snippets for Azure, Prometheus exporter - remove 5408.patch, which became redundant
peter czanik2025-07-16 15:19:44 +00:00
f99a3a7b1a
Accepting request 1288252 from Base:System
Ana Guerrero2025-06-24 18:50:29 +00:00
903552e2e8
- add patch (5408.patch) to compile GRPC-based modules with latest protobuf version
peter czanik2025-06-24 12:38:53 +00:00
6ba19db077
- add patch to compile GRPC-based modules with latest protobuf version
peter czanik2025-06-24 11:01:08 +00:00
bc6bedaf43
- update to 4.8.2 which is a bug fix release: * fixes an inproper certificate validation problem (CVE-2024-47619) * fixes elasticsearch-http() and other drivers after a backwards incompatible fix in format-json * reliability and performance improvements in the S3 destination
peter czanik2025-05-08 09:02:28 +00:00
0fd9cde590
Accepting request 1266815 from Base:System
Ana Guerrero2025-04-03 14:50:32 +00:00
18bf8ac36f
- rename syslog-ng-curl to syslog-ng-http - fix rpmlint reports
peter czanik2024-10-31 10:36:17 +00:00
9f3834f08b
Accepting request 1216722 from Base:System
Ana Guerrero2024-10-22 12:51:43 +00:00
100f74e66c
- fixes to make sure that syslog-ng builds on Leap 16.0 * disable features with missing dependencies * do not use a fixed clang version
peter czanik2024-10-21 12:38:57 +00:00
55b903edc9
Accepting request 1207024 from Base:System
Ana Guerrero2024-10-11 15:02:34 +00:00
d1dbd3c96f
Use SOURCE_DATE_EPOCH for reproducible jar mtime
peter czanik2024-10-11 04:26:07 +00:00
0b3dce2688
Accepting request 1206571 from Base:System
Ana Guerrero2024-10-10 20:11:13 +00:00
17f858c3eb
- update to version 4.8.1, a bug fix release, fixing several problems reported by openSUSE users upstream (pipe source, etc.) - added Elasticsearch datastream destination
peter czanik2024-10-09 17:19:39 +00:00
969db28af6
Accepting request 1201548 from Base:System
Ana Guerrero2024-09-17 16:18:54 +00:00
41f46ce7b0
Replace obsolete udp() example in configuration with a dual stack network() one
peter czanik2024-09-17 08:27:33 +00:00
0ad9f5225b
- update to version 4.8.0 * add new parsers * improved file reading and directory monitoring * new S3 authentication and encryption options * new http metrics * many OpenTelemetry fixes and improvements - fix syslog-ng-devel dependencies (boo#1219672) - add python3-setuptools as a build requiriement - update to version 4.6.0 * BigQuery support * CloudAuth support * Loki support * PubSub support * parsers for pgsql, pihole, qbittorrent logs - move grpc support into separate sub-package - fix boo#1215386 by removing dependency on var-run.service (service is removed in Tumbleweed) - update to version 4.3.1 * fixes a crash bug in Python support * opensearch destination (SCL) - update to version 4.3.0 * OpenTelemetry support * BPF support to accelerate UDP source * logscale destination * scl.conf moved from /etc/syslog-ng * use pcre2 instead of pcre - change BuildRequires from pcre-devel to pcre2-devel - add BuildRrequires for OpenTelemetry and BPF - fix Python packaging - oops, forgot to update the config version string again... - while there, fixed a config warning about statistics - update to version 4.2.0 - add Splunk destination to SCL - plugin rename: dbparser is now called correlation - new plugin: libmetrics-probe.so - split Python-based drivers from the Python plugin - Exclude plugins from being turned into RPM dependencies. - update to 4.0.1 - remove obsolate syslog-ng-nojavah.patch together with autotools dependencies - add dependencies for Python modules - remove obsolate Obsolates line - remove Kubernetes config (became a Python module) - Replace transitional %usrmerged macro with regular version check (boo#1206798) - update to 3.37.1 - add new modules to file lists - enable MQTT support only for Tumbleweed - URL -> https - Added patch: * syslog-ng-nojavah.patch + Do not use the removed javah tool, but the javac's -h option + Allows to build with any java-devel >= 1.8 - Require java-devel >= 1.8 for build - Add build dependency on autoconf and automake since we need them to regenerate the build system after we patch it - disable Java support for ARMv7 (compilation crashes) - update to 3.35.1 - remove "news" user creation, as it is no more referenced from the configuration file - packaging fixes to remove a few warnings - update to 3.33.2 - added support for parsing CEE and Fortigate logs - added Discord destination - added MQTT destination support - python3 workdaround removed (commented out for now, fixed upstream) - Set shebang for merge-grammar.py to be /usr/bin/python3. - update to 3.30.1 - follow up snmp support changes - add secure logging - add PAN-OS parser - add SumoLogic destination - prepare usrmerge (boo#1029961) - fix bnc#1169385 by removing creating news log files from post, adding syslog-ng.conf options to create files/directories automatically, and commenting the relevant part out. - fix libevtlog package name - Update to 3.26.1 * added a new option to multi-line file sources * python-http-header: added this new plugin, which makes it possible for users to implement HTTP header plugins in Python language * azure-auth-header: Added this new plugin, which generates authorization header for applications connecting to Azure * set-severity(): Added this new rewrite rule for changing message severity. * $(list-search): Added a new template function, which returns the first index of a pattern in a list. * other minor improvements * many bug fixes - Fix fixing Python shebang - BuildRequire pkgconfig(libsystemd) instead of systemd-devel: allow OBS to shortcut through -mini flavors. - update to 3.25.1 - many bug fixes, improved Redis destination performance - remove ExcludeArch as bison workaround no more needed - remove dependency on libgeoip to fix bnc#1156203 (of course libmaxminddb is still supported) - updated to 3.23.1 to resolve bnc#1143190 - removed 2482.patch as it was merged upstream - add wensense & netskope parsers - add collectd support - update syslog-ng.conf due to an undocumented include syntax used in the config was removed by uspstream - add SCL to support Elasticsearch destination using the http() destination driver - add SCL to parse junos and checkpoint logs - changed the location of debuggercli files - disabled native connector (Rust support) - "ExcludeArch: i586 s390x" as workaround until bison is fixed - oops, forgot to update version in syslog-ng.conf again... - moved slack SCL to curl sub-package to silence warning on startup - Dynamically detect used python3 version. - added 2482.patch to resolve GPL-2.0 vs. BSD-4-Clause compatibility problem. - Allow building with java 1.8.0. - Use %license - updated to 3.19.1 - changed summary again - Replace time-sensitive wording of summary. - Drop %if..%endif guards that are idempotent. - Replace %__-type macro indirections. - update to 3.18.1 - remove support for SLES11 (sysvinit) - add support to compile on SLES12+ and Leap 42+ - tons of clean-up - added network.target to syslog-ng.service to resolve bnc#1077975 - update to syslog-ng 3.14.1 - remove patch, as merged upstream: 0001-modules-json-Adaptions-for-json-c-v0.13.patch - remove patch and revert to jdk 1.7 as 1.9 is problematic: syslog-ng-3.10.1-sourcetarget.patch - add secret-storage, appmodell and SCL files - fix build error with json-c v0.13 with patch 0001-modules-json-Adaptions-for-json-c-v0.13.patch - disable Java destination temporarily (it does not build) - fix %post and mongodb as requested by @idonmez - update to syslog-ng 3.12.1 - add tags parser - add xml parser - add Windows eventlog parser - add syslog-ng-debun + man - handle evtlog merge (add obsolates, new files, etc.) - use Python version of merge-grammar - add libmaxminddb-devel BuildRequires for the geoip2 parser - add geoip2 parser - add osquery parser (scl) - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) (by @RBrownSUSE) - WARNING: disable RabbitMQ and AMQP support as they fail to compile with openssl 1.1 Will be most likely re-enabled in 3.14.1 - Update package summaries and RPM group classifications. Drop author lists from descriptions. Remove redundant %clean section. Replace old $RPM_ shell vars and make consistent use of macros instead. - Do not hardcode dependency on java-1_7_0-openjdk, depend on java-devel >= 1.7 instead - Added patch: * syslog-ng-3.10.1-sourcetarget.patch + Build Java classes with the lowest required source and target levels. - update to version 3.10.1 - update config version - libcurl.so renamed to libhttp.so - added module libtfgetent.so - added module libmap-value-pairs.so - added module libstardate.so - added cisco parser (scl) - added snmptrapd parser files - add pkgconfig for add-contextual-data - don't compile curl dest on SLES 11 - require group and user "news" in new system model. - really update config version to 3.8 (thanks Per for the report) - move curl (HTTP) support into a subpackage to reduce the number of dependencies in the base package - update to 3.8.1 for a complete list of changes see: https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.8.1 - add Java support. NOTE: no modules due to missing gradle and JAR dependencies - add curl HTTP support - disable mongodb for SLES11 (fails to compile) - update configuration to 3.8 - change datadir parameter (default now includes 'syslog-ng') - add cef & date modules, apache, loggly, logmatic scl-s - add disk buffer support - update java module list - uncomment Alias=syslog.service in syslog-ng.service - rename system-expand to system-expand.sh - add missing: Obsolates: syslog-ng-json (JSON is now in core) - fix bnc#965191 by adding back "Alias=syslog.service" to "syslog.service" - update to 3.7.3, which fixes many small bugs https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.7.3 - remove obsolate e30fe7c3717a7bda4036448c7777747df1a4e0f9.patch - using self generated dist tgz, as official tgz is missing generated man pages - fix bnc#982487 by copying config.h manually - update to syslog-ng 3.7.1 - for a detailed changelog, see upstream at: https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.7.1 and https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.6.1 - FYI: no java support due to lack of gradle - follow geoip modul name change (tfgeoip -> geoip-plugin) - add libkvformat.so - remove notls workaround (openssl is now a hard dependency) - add python support - update version in syslog-ng.conf - move json support to core - tmp patch to fix compilation on SLES11: e30fe7c3717a7bda4036448c7777747df1a4e0f9.patch - SLES notes: some core dependencies are missing, so you need to build in your home repo and have json, libevtlog from Factory - fix shebang in syslog-ng-service-prepare script that contains bash-specific constructions - Do not BuildRequire libhiredis0_10: It's responsibility of the respective -devel package to pull in the library. On openSUSE < 13.2.1 (Current Tumbleweed) we keep it to workaround a bug in the hiredis-devel package of those releases. - Stop syslog.socket in %preun to avoid the daemon we uninstall gets started by a log message due to dependencies (bnc#840815). - update to 3.5.6 (bugfix release) - update to 3.5.5 (bugfix release) - copying ivykis headers manually is no more necessary - rpm: use _rundir rpm macro if defined (bnc#873857) - update to 3.5.4.1 For a full list of syslog-ng 3.5 related changes, please check the upstream changelog at: http://www.balabit.com/downloads/files/syslog-ng/open-source-edition/3.5.4.1/changelog-en.txt - updated config version to 3.5 - added new modules (redis, stomp, etc.) - use system(); for local logs, which fixes bnc#846762 https://bugzilla.novell.com/show_bug.cgi?id=846762 - add /etc/syslog-ng/conf.d/ as include dir to config - added devel package, so external modules can be built (like those from the syslog-ng incubator project) - Added Restart=on-abort to syslog-ng.service (fate#315133) - update 3.4.5 (bugfix release) - update 3.4.4 (bugfix release) - update to 3.4.3 (bugfix release) - update to 3.4.2, which fixes bnc#815746 https://bugzilla.novell.com/show_bug.cgi?id=815746 - many bugfixes, including flags(final) - Fix systemd unit to do only what is required by http://www.freedesktop.org/wiki/Software/systemd/syslog in particular it should not mess with the ordering of syslog.target - Fixed to use program() instead of message() to match by program names (bnc#805309). - updated configuration version from 3.3 to 3.4 - update to 3.4.1 release - bugfixes - update to 3.4 RC2 - bugfixes - updates bundled ivykis to 0.36 - Enable syslog-ng.service and create the syslog.service alias link in post install -- regardless of a preset config (bnc#790805). - Check the existence of /etc/init.d/syslog script before calling the restart_on_update and stop_on_removal macros to avoid errors on update. Since openSUSE 12.3, no syslog init script is shipped (bnc#790298,bnc#750478). - update to 3.4 RC1 (only bugfixes) - removed temporary syslog-ng-systemd.patch - update to 3.4 beta1 (only bugfixes) - added smtp support - enable features explicitely (add --enable-XXX for mongodb and amqp) - add syslog-ng-systemd.patch temporarilty to fix bug when starting from systemd - enable GeoIP support into separate subpackage - update to 3.4 git HEAD - many new features, including: - junctions and more complicated log processing paths - amqp destination - smtp destination - json output and parser plugins - key rewriting in destination drivers (add, remove prefixes) - a number of new template functions (uuid, hash functions, etc) - a number of new parsers in db-parser (set, pcre, ...) - allow 32 bit message and nvpair sizes - improved systemd support - demand loaded plugins - plugin support for log transport protocols and the network driver to be able to use them easily - add/remove files from pkglist - added python needed by SLES - Require syslog-service >= 2.0 on 12.3, otherwise < 2.0, which contain the /etc/init.d/syslog init script. - Fixed build requires / deps to work on 12.x and SLE-11-SP2. - Initialized SYSLOG_NG_PARAMS env variable in service file. - Marked additional log sockets file as ghost. - Added syslog-ng.service and prepare script to spec file sources. - Changed to provide a specific syslog-ng.service file which creates an alias to syslog.service while activation instead of using a SYSLOG_DAEMON to choose the syslog daemon. A short pre-exec script is used to generate the additional (chroot) log socket config (bnc#788330). - Updated syslog provides/requires and added a conflict with otherproviders(syslog). - Dropped all ifdef-s and cleaned up to specify all relevant directories via rpm macros. - Changed to install in /usr/sbin, compatibility link in /sbin. - remove ifdef-s related to 11.X support except for systemd (so SLES support could be fixed) - remove no more used parts from spec - remove syslog-ng.rc-script from sources - update to 3.3.7 release - some last minute bugfixes - update to 3.3.7rc2 - bugfix release - update to 3.3.6 with many small bugfixes, upstream ivykis support, glob support for includes - systemd patch no more necessary - less static patch removed, as it was necessary for 11.X - update to git head - update to syslog-ng 3.3.5 which fixes even more memleaks - resolves bnc#757680 - Detect if we have to use the new /run/systemd/journal/syslog socket under newer systemd versions, instead of the default _PATH_LOG (/dev/log) socket. Avoids update problems and the need to adopt config before using init=... boot parameter (bnc#747871). - more changelog, as requested by saschpe v3.3.1 was the initial syslog-ng 3.3 release fixes and changes, taken from the syslog-ng NEWS file - Fixes: * Fixed set() and subst() rewrite operations to work properly on the value() parameter specified in the configuration even if they are referenced at multiple spots in the configuration file. Earlier the 2nd and subsequent invocation of the rewrite rule changed $MESSAGE. * Fixed csv-parser() to work even if it is invoked at multiple spots in the configuration file. Earlier, the 2nd and subsequent references of the parser rule forgot the list of column names and the input template. * Fixed the processing of condition() parameter in rewrite rules, which was broken if it contained a filter() function call. * Fixed program() destination to properly kill the child process on reload and shutdown. * Fixed a potential division by zero error which could happen for large data rates due to a race in an unlocked region. * Fixed an assertion failure in mongodb destination that happened due to a race condition at high data rates. * Fixed an fd leak in the control socket code, that caused the control connection file descriptors to be leaked. * Fixed a crash problem in the tcp() destination, that occurred at or after a reload happens. * Fixed a segmentation fault on reload when using the same rewrite rule from multiple log paths. * Fixed a segmentation fault when processing a reload request in case an existing tcp() source is removed from the config and there are open connections. * Fixed a possible segmentation fault in the scalable queue implementation, which happens in case a destination is slower to process messages than syslog-ng would like to send them. * Fixed a possible file() destination issue that could cause syslog-ng to omit data or to write garbage to the log file in case the kernel reports that only a smaller portion of the actual write request could be accomplished. * Fixed an "internal error duplicate config element" error during reload due to an invalid bugfix applied for 3.3.1. Older beta versions of 3.3 were not affected. * Fixed a memory leak that causes macro based file destinations to leak their queue when destination files are closed due to time-reap(). * Fixed the handling of the condition() option for rewrite rules. * Fixed a race condition in value-pairs support, potentially causing heap corruption problems when $(format-json) is used in threaded mode. * Fixed a memory leak in value-pairs template function argument parsing, fixing a leak if $(format-json) is used. * Repeated definitions of source, destination, filter, rewrite, parser and block elements are not allowed by default anymore. These are reported as configuration errors unless @define allow-config-dups 1 is specified in the configuration file. * Fixed pdbtool error reporting in "pdbtool test" to make it easier to understand what went wrong. * Added an SQL connection health check in case an INSERT failed. This way syslog-ng handles SQL server timeouts better. * Fixed support for systemd socket activation. Previously such sockets were not set to non-blocking mode, causing syslog-ng to hang. * Fixed the filter() function in the filter expression to work also when used as a part of an AND or OR construct. * Allow the sql() destination to operate even without an indexes() option. That parameter was meant to be optional, but it wasn't. * Fixed compilation issues if no OpenSSL is present. * Fixed a minor memory leak in the usertty() driver that can increase memory usage on every reload. (The username() parameter wasn't properly freed on reload). * Fixed a minor memory leak in the sql() driver that can increase the memory usage on every reload (indexes() parameter wasn't properly freed on reload). - Changes * db-parser() automatically sets a tag named '.classifier.unknown' if the message doesn't match. * The use of actions in db-parser() for messages without a correllation context was inconsistently indexing messages. For actions in rules that had correllation @0 was the new message being generated, and @1 was the message that triggered the rule. Without correllation @0 was used for the triggering message, which is greatly inconsistent and unintuitive. This was fixed by changing the behaviour for rules without correllation, now both correllation and non-correllation rules use @0 for the new message, and @1 for the triggering message. This is an incompatible change in the db-parser() format. * The value of the $TAGS macro is added to pdbtool match output. * unix-dgram() and unix-stream() error logging on systemd failures became more detailed for easier troubleshooting. - fix systemd support for openSUSE > 12.1 - update to 3.3.4 - update to the latest 3.3-git - update to 3.3.3 - remove filter patch - fix afsql related warning - remove call to suse_update_config (very old work around) - add patch for filters bug https://bugzilla.balabit.com/show_bug.cgi?id=140 so firewall logs are correctly filtered - update to 3.3.1 (3.3 final) which fixes some more minor problems and updates NEWS - updated to latest git, which made time patch redundant and also fixes for mongodb, memory leaks, etc. - fix 11.3 packaging - enable json support also for 11.4 - updated to latest git snapshot including fix for bnc#719102 - enabled capabilities support >11.4 only - moved libafmongodb to /usr - added fix for compiledate - changed time patch to configure option (which does not work yet...) - removed patches previously picked from git - fix for an ugly BSD date problem: when using original dates in September - December, all turn up as from December patch to be removed on next release - Adopted to require new syslog-service package on 12.x, that provides the /etc/init.d/syslog LSB init script and systemd syslog.service service file. Removed syslog-ng.service file installation from spec file. (fate#311316). - updated to syslog-ng-3.3.0beta2, a new major release with many new features: * full multi threading * mongodb and json output support * new default port numbers for syslog() For complete list, please read NEWS file provided in the package. - removed some unnecessary docs (INSTALL, etc.) - updated config and enabled multi threading by default - added json subpackage - keep only libafsocket.so (the notls version is not used) - Updated to syslog-ng-3.2.4, maintenance release fixing several issues -- a digest of the changes: * A bug was found in the pcre implementation for subst(). If the "global" flag is specified and pcre returns an error, an infinite loop is created, consuming memory in the process. It is triggered by PCRE 8.12, but could potentially affect older versions too. (bnc#697374, CVE-2011-1951) * Fixed a potential use of uninitialized memory in the configuration file parser, no bug was triggered but gcc 4.6 reported it via a warning. * Fixed a possible security issue on Debian/kFreeBSD and on platforms where mode_t is an unsigned 16 bit value (FreeBSD,HP-UX). (CVE-2011-0343) * Fixes an y2k38 problem that causes syslog-ng to use 100% CPU time in case mark messages are enabled and the UNIX timestamps overflows a signed 32 bit counter, which happens in 19th, January 2038. * Fixed file() destination to work on device nodes (e.g. files in /dev). Without this change, syslog-ng started using 100% CPU time if given devices as destinations that couldn't always consume data. * Don't attempt to remember the current file position for source files that are read with follow-freq(0), e.g. /dev/klog and /proc/kmsg. * Added systemd socket activation support. For complete list, please read NEWS file provided in the package. - Removed obsolete systemd integration patch, added to install syslog-ng service file as forced in bnc#696963 even feature 311316 is not yet implemented, that is, log rotation files do not work, chroot socket config file is never generated when running under systemd. - Enabled to read kernel messages directly (/proc/kmsg) for 12.x - Added generation of dummy additional-log-sockets.conf in post install - Adopted less static patch to build on 11.3. - Removed touch of obsolete /var/log/boot.log from spec post. - Fixed typo module-path in the config file (bnc#664931#c5). - Moved sql support lib into separate syslog-ng-sql package, adopted the module-path patch and disabled loading of the sql module in scl/modules.conf config file by default. Adopted spec file to use with_sql for conditional build. - added module-path patch to be able to load modules also from /usr and removes an ugly warning message - Merged all the systemd integration steps patches into one. - added systemd patches from algernon@balabit.hu - add database (libdbi) support for 11.4 and up - use systemd patches only on 11.4 and up - Updated systemd support to the patch set sent upstream and additional workaround to not break the syslog-ng.ctl sock. Current limitation is, that *all* unix sockets have to be set up same way, that is either systemd activated or not, because the systemd patch disables unlink&bind functions. - temporarily disabled systemd support - update to 3.2.2 bugfix release - Implemented a first version of systemd socket activation support - Enabled suppress config option to catch log message dupplicates in case a program runs amok until disk is full (bnc#656197). - Disabled build date/time in binary to avoid rebuild (rpmlint). - Do not install /lib*/libsyslog-ng.so devel file (rpmlint). - update to 3.2.1 release - libdbi support is added but commented out (libdbi not yet in factory) - many little fixes (added man pages, new config files, etc.) - the new system() from upstream not yet used because of AppArmor - build against the dynamic glib in /lib on 11.4 to fix build - build against libnet-devel on 11.4 - update to version 3.1.2, which makes most of the patches redundant - an upstream modified version of the old SuSE patch: syslog-ng-avoid-getpwgrnam_-1.dif - some more patches accepted by upstream: bnc#568150 - removed /var/tmp/syslog-ng from rpm to prepare for https://features.opensuse.org/303793 - upstream accepted some patches from the 2.0.9 openSUSE package, applied now, as 3.1.2 is still far away
peter czanik2024-07-30 09:42:40 +00:00
Ana Guerrero
peter czanik
Dominique Leuenberger
Yuchen Lin
Marcus Meissner