From 2a98edf43bc91c6852712f9c37f35df6a5483b01 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Thu, 28 Jun 2007 06:50:57 +0000 Subject: doc updates for release 1.14.0 --- doc/bugs.html | 108 +++++++++++++++++++++++++++--------------------------- doc/features.html | 97 ++++++++++++++++++++++++------------------------ doc/status.html | 6 +-- 3 files changed, 107 insertions(+), 104 deletions(-) (limited to 'doc') diff --git a/doc/bugs.html b/doc/bugs.html index 1903ba5b..adb37928 100644 --- a/doc/bugs.html +++ b/doc/bugs.html @@ -1,54 +1,54 @@ - - -rsyslog bugs and annoyances - - -

rsyslog bugs and annoyances

This page lists the known bugs rsyslog has to offer. Please note that -we also have a - -bug tracker at sourceforge.net. This list here contains more architectural -things while the bug tracker most often lists things that you will actually -experience. I am working to combine the two lists, but for now you need to visit -both.

This list has last been updated on 2005-09-26 by -Rainer Gerhards.

rsyslogd

REPEATED LOG LINES

If multiple log lines with the exact same content are received, - the duplicates are NOT suppressed. This is done by sysklogd - in all cases. We plan to add this as an optional feature, - but as of now every line is logged.

ERRORS ON STARTUP

Error reporting on startup is not particular good. We handle all - errors correctly, but sometimes a message is only reported if - running in debug mode. If you experience some strange behaviour - I suggest to run the syslogd interactively with debugging enabled. - As of August, 2005, the situation has much improved. Keep in mind, - thought, that debug mode is your friend ;)

EQUALLY-NAMED TEMPLATES

If multiple templates with the SAME name are created, all but the - first definition is IGNORED. So you can NOT (yet) replace a - template definition. I also strongly doubt I will ever support this, because -it does not make an awful lot of sense (after all, why not use two template -names...).

MEMORY LEAK ON HUPING

Currently, the template memory is NOT freed when SIGHUP is received. - This causes a small memory leak on each HUP. Will be fixed soon and - should not cause real trouble unless you HUP syslogd quite frequently.

WALLMSG FORMAT (* selector) -

This format is actually not 100% compatible with stock syslogd - the - date is missing. Will be fixed soon and can also be fixed just via - the proper template. Anyone up for this? ;)

SIGPIPE HANDLING

Currently, SIGPIPE is ignored. This is necessary to handle broken TCP - connections. We should further look into this issue and see which other - ways exist to handle the situation.

MULTIPLE INSTANCES

If multiple instances are running on a single machine, the one with - the -r switch must start first. Also, UDP-based syslog forwarding between the -instances does not work. Use TCP instead.

- - - + + +rsyslog bugs and annoyances + + +

rsyslog bugs and annoyances

This page lists the known bugs rsyslog has to offer. Please note that +we also have a + +bug tracker at sourceforge.net. This list here contains more architectural +things while the bug tracker most often lists things that you will actually +experience. Please be sure to visit the bug tracker in addition to this list +here.

This list has last been updated on 2007-06-28 by +Rainer Gerhards.

rsyslogd

IPv6

IPv6 is currently supported for UDP, only. TCP support is to follow.

AllowedSender and IPv6

AllowedSenders currently can be used with IPv4, only. IPv6 senders are always +allowed. If you need access control for IPv6, use iptables. AllowedSender +support for IPv6 will most probably be added. Please note that you can also +disable IPv6 support by specifying -4 on the command line.

REPEATED LOG LINES

If multiple log lines with the exact same content are received, + the duplicates are NOT suppressed. This is done by sysklogd + in all cases. We plan to add this as an optional feature, + but as of now every line is logged.

EQUALLY-NAMED TEMPLATES

If multiple templates with the SAME name are created, all but the + first definition is IGNORED. So you can NOT (yet) replace a + template definition. I also strongly doubt I will ever support this, because +it does not make an awful lot of sense (after all, why not use two template +names...).

MEMORY LEAK ON HUPING

Currently, the template memory is NOT freed when SIGHUP is received. + This causes a small memory leak on each HUP. Will be fixed soon and + should not cause real trouble unless you HUP syslogd quite frequently.

WALLMSG FORMAT (* selector) +

This format is actually not 100% compatible with stock syslogd - the + date is missing. Will be fixed soon and can also be fixed just via + the proper template. Anyone up for this? ;)

SIGPIPE HANDLING

Currently, SIGPIPE is ignored. This is necessary to handle broken TCP + connections. We should further look into this issue and see which other + ways exist to handle the situation.

MULTIPLE INSTANCES

If multiple instances are running on a single machine, the one with + the -r switch must start first. Also, UDP-based syslog forwarding between the +instances does not work. Use TCP instead.

+ + + diff --git a/doc/features.html b/doc/features.html index aceae9f0..8c7fbea9 100644 --- a/doc/features.html +++ b/doc/features.html @@ -1,47 +1,50 @@ - - -rsyslog features - - -

RSyslog - Features

This page lists both current features as well as those being considered -for future versions of rsyslog. If you think a feature is missing, drop -Rainer a note. Rsyslog is a vital -project. Features are added each few days. If you would like to keep up of what -is going on, you can also subscribe to the rsyslog mailing list. -

Current Features

native support for writing to MySQL databases
support for (plain) tcp - based syslog - much better reliability
support for sending and receiving - compressed syslog messages
support for receiving messages via reliable RFC 3195 delivery
control of log output format, - including ability to present channel and priority as visible log data
good timestamp format control; at a minimum, ISO 8601/RFC 3339 - second-resolution UTC zone
ability to reformat message contents and work with substrings
support for - log files larger than 2gb
support for file size limitation and automatic - rollover command execution
support for running multiple rsyslogd - instances on a single machine
support for - ssl-protected syslog (via stunnel)
ability to filter on any part of - the message, not just facility and severity
support for discarding - messages based on filters
ability to execute shell scripts on received - messages
control of whether the local hostname or the hostname of the - origin of the data is shown as the hostname in the output
ability to - preserve the original hostname in NAT environments and relay chains -
ability to limit the allowed network senders
powerful BSD-style hostname and program name blocks for easy multi-host support
multi-threaded - currently experimental
very experimental and volatile support for syslog-protocol compliant messages (it is volatile because standardization is currently underway and this is a proof-of-concept implementation to aid this effort)
- experimental support for syslog-transport-tls based framing on syslog/tcp - connections
- a copy of klogd.c has been included under the name of rklogd for those Linux - systems that need one. So rsyslog is a full replacement for the sysklogd - package

Upcoming Features

support for native SSL enryption of plain tcp syslog sessions. This will - most probably happen based on syslog-transport-tls.
even more enhanced multi-threading
support for RFC 3195 as a sender - planned
pcre filtering - maybe (depending on feedback) - simple regex already - partly added. So far, this seems sufficient so that there is no urgent

To see when each feature was added, see the -rsyslog change log (online -only).

- - + + +rsyslog features + + +

RSyslog - Features

This page lists both current features as well as those being considered +for future versions of rsyslog. If you think a feature is missing, drop +Rainer a note. Rsyslog is a vital +project. Features are added each few days. If you would like to keep up of what +is going on, you can also subscribe to the rsyslog mailing list. +

Current Features

native support for writing to MySQL databases
support for (plain) tcp + based syslog - much better reliability
support for sending and receiving + compressed syslog messages
support for receiving messages via reliable RFC 3195 delivery
control of log output format, + including ability to present channel and priority as visible log data
good timestamp format control; at a minimum, ISO 8601/RFC 3339 + second-resolution UTC zone
ability to reformat message contents and work with substrings
support for + log files larger than 2gb
support for file size limitation and automatic + rollover command execution
support for running multiple rsyslogd + instances on a single machine
support for + ssl-protected syslog (via stunnel)
ability to filter on any part of + the message, not just facility and severity
support for discarding + messages based on filters
ability to execute shell scripts on received + messages
control of whether the local hostname or the hostname of the + origin of the data is shown as the hostname in the output
ability to + preserve the original hostname in NAT environments and relay chains +
ability to limit the allowed network senders
powerful BSD-style hostname and program name blocks for easy multi-host support
multi-threaded
very experimental and volatile support for syslog-protocol compliant messages (it is volatile because standardization is currently underway and this is a proof-of-concept implementation to aid this effort)
+ experimental support for syslog-transport-tls based framing on syslog/tcp + connections
+ a copy of klogd.c has been included under the name of rklogd for those Linux + systems that need one. So rsyslog is a full replacement for the sysklogd + package
+ support for IPv6 (currently UDP only, but TCP will be added soon)

Upcoming Features

support for native SSL enryption of plain tcp syslog sessions. This will + most probably happen based on syslog-transport-tls.
even more enhanced multi-threading
pcre filtering - maybe (depending on feedback) - simple regex already + partly added. So far, this seems sufficient so that there is no urgent
support for RFC 3195 as a sender - this is currently unlikely to happen, because there is no real + demand for it. Any work on RFC 3195 has been suspend until we see some real + interest in it. It is probably much better to use TCP-based syslog, + which is interoprable with a large number of applications.

To see when each feature was added, see the +rsyslog change log (online +only).

+ + diff --git a/doc/status.html b/doc/status.html index af4f8ad5..8668e577 100644 --- a/doc/status.html +++ b/doc/status.html @@ -4,10 +4,10 @@

rsyslog status page

This page reflects the status as of 2007-06-22.

This page reflects the status as of 2007-06-28.

Current Releases

development: 1.13.5 - change log - -download

development: 1.14.0 - change log - +download

stable: 1.0.4 - change log - download

(How are versions named?)

-- cgit