openSUSE Recommended Update: rsyslog: Updated to 5.10.0 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2012:1249-1 Rating: low References: #753077 #778769 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update fixes the following issues for rsyslog: - Updated to 5.10.0 [V5-stable] (bnc#753077, bnc#778769), the actual rsyslog v5-stable series, incorporating all fixes the 5.8.x [EOL V5-stable] and changes from 5.9.x series. It turns off rate limiting on unix socket by default (caused problems) and fixes privilege drop. A digest of the changes (see ChangeLog for complete list): - added capability to specify substrings for field extraction mode - added configuration directives to customize queue light delay marks - permit size modifiers (k,m,g,...) in integer config parameters - added configuration directive to disable octet-counted framing for imtcp, directive is $InputTCPServerSupportOctetCountedFraming for imptcp, directive is $InputPTCPServerSupportOctetCountedFraming - added capability to use a local interface IP address as fromhost-ip for locally originating messages. New directive $LocalHostIPIF - improved impstats subsystem, added many new counters - enhanced module loader to not rely on PATH_MAX - refactored imklog linux driver, now combined with BSD driver. The Linux driver no longer supports outdated kernel symbol resolution, which was disabled by default for very long. Also overall cleanup, resulting in much smaller code. Linux and BSD are now covered by a single small driver. - $IMUXSockRateLimitInterval DEFAULT CHANGED, was 5, now 0. The new default turns off rate limiting. This was chosen as people experienced problems with rate-limiting activated by default. Now it needs an explicit opt-in by setting this parameter. - imuxsock: added capability to "annotate" messages with "trusted information", which contains some properties obtained from the system and as such sure to not be faked. This is inspired by the similiar idea introduced in systemd. - removed dependency on gcrypt for recently-enough GnuTLS - added capability to emit config error location info for warnings otherwise, omusrmsg's warning about new config format was not accompanied by problem location. - added support for obtaining timestamp for kernel message from message. If the kernel time-stamps messages, time is now take from that timestamp instead of the system time when the message was read. This provides much better accuracy. - added support for obtaining timestamp from system for imuxsock. This permits to read the time a message was submitted to the system log socket. Most importantly, this is provided in microsecond resolution. So we are able to obtain high precision timestampis even for messages that were - as is usual - not formatted with them. This also simplifies things in regard to local time calculation in chroot environments. - imfile: added $InputFileMaxLinesAtOnce directive - enhanced imfile to support input batching - added capability for imtcp and imptcp to activate keep-alive packets at the socket layer. This has not been added to imttcp, as the latter is only an experimental module, and one which did not prove to be useful. - added support to control KEEPALIVE settings in imptcp this has not yet been added to imtcp, but could be done on request. - $ActionName is now also used for naming of queues in impstats as well as in the debug output - bugfix: do not open files with full privileges, if privs will be dropped. This make the privilege drop code more bulletproof, but breaks Ubuntu's work-around for log files created by external programs with the wrong user and/or group. Note that it was long said that this "functionality" would break once we go for serious privilege drop code, so hopefully nobody still depends on it (and, if so, they lost...). - bugfix: pipes not opened in full priv mode when privs are to be dropped - better handling of queue i/o errors in disk queues. This is kind of a bugfix, but a very intrusive one, this it goes into the devel version first. Right now, "file not found" is handled and leads to the new emergency mode, in which disk action is stopped and the queue run in direct mode. An error message is emited if this happens. - added support for user-level PRI provided via systemd - added new config directive $InputTCPFlowControl to select if tcp received messages shall be flagged as light delayable or not. - enhanced omhdfs to support batching mode. This permits to increase performance, as we now call the HDFS API with much larger message sizes and far more infrequently - bugfix: delayble source could block action queue, even if there was a disk queue associated with it. The root cause of this problem was that it makes no sense to delay messages once they arrive in the action queue – the “input” that is being held in that case is the main queue worker, what makes no sense. - bugfix: disk queue was not persisted on shutdown, regression of fix to http://bugzilla.adiscon.com/show_bug.cgi?id=299. The new code also handles the case of shutdown of blocking light and full delayable sources somewhat smarter and permits, assuming sufficient timouts, to persist message up to the max queue capacity. Also some nits in debug instrumentation have been fixed. - add small delay (50ms) after sending shutdown message. There seem to be cases where the shutdown message is otherwise not processed, not even on an idle system. Thanks to Marcin for bringing this problem up. - support for resolving huge groups - bugfix: potential hang due to mutex deadlock closes: http://bugzilla.adiscon.com/show_bug.cgi?id=316 Thanks to Andreas Piesk for reporting and analyzing this bug as well as providing patches and other help in resolving it. bugfix: property PROCID empty instead of proper nilvalue if not present If it is not present, it must have the nilvalue “-” as of RFC5424 closes: http://bugzilla.adiscon.com/show_bug.cgi?id=332 - bugfix: “last message repeated n times” message was missing hostname. bugfix: multiple main queues with same queue file name was not detected This lead to queue file corruption. While the root cause is a config error, it is a bug that this important and hard to find config error was not detected by rsyslog. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-648 - openSUSE 12.1: zypper in -t patch openSUSE-2012-648 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): rsyslog-5.10.0-2.4.1 rsyslog-debuginfo-5.10.0-2.4.1 rsyslog-debugsource-5.10.0-2.4.1 rsyslog-diag-tools-5.10.0-2.4.1 rsyslog-diag-tools-debuginfo-5.10.0-2.4.1 rsyslog-doc-5.10.0-2.4.1 rsyslog-module-dbi-5.10.0-2.4.1 rsyslog-module-dbi-debuginfo-5.10.0-2.4.1 rsyslog-module-gssapi-5.10.0-2.4.1 rsyslog-module-gssapi-debuginfo-5.10.0-2.4.1 rsyslog-module-gtls-5.10.0-2.4.1 rsyslog-module-gtls-debuginfo-5.10.0-2.4.1 rsyslog-module-mysql-5.10.0-2.4.1 rsyslog-module-mysql-debuginfo-5.10.0-2.4.1 rsyslog-module-pgsql-5.10.0-2.4.1 rsyslog-module-pgsql-debuginfo-5.10.0-2.4.1 rsyslog-module-relp-5.10.0-2.4.1 rsyslog-module-relp-debuginfo-5.10.0-2.4.1 rsyslog-module-snmp-5.10.0-2.4.1 rsyslog-module-snmp-debuginfo-5.10.0-2.4.1 rsyslog-module-udpspoof-5.10.0-2.4.1 rsyslog-module-udpspoof-debuginfo-5.10.0-2.4.1 - openSUSE 12.1 (i586 x86_64): rsyslog-5.10.0-6.7.1 rsyslog-debuginfo-5.10.0-6.7.1 rsyslog-debugsource-5.10.0-6.7.1 rsyslog-diag-tools-5.10.0-6.7.1 rsyslog-diag-tools-debuginfo-5.10.0-6.7.1 rsyslog-doc-5.10.0-6.7.1 rsyslog-module-dbi-5.10.0-6.7.1 rsyslog-module-dbi-debuginfo-5.10.0-6.7.1 rsyslog-module-gssapi-5.10.0-6.7.1 rsyslog-module-gssapi-debuginfo-5.10.0-6.7.1 rsyslog-module-gtls-5.10.0-6.7.1 rsyslog-module-gtls-debuginfo-5.10.0-6.7.1 rsyslog-module-mysql-5.10.0-6.7.1 rsyslog-module-mysql-debuginfo-5.10.0-6.7.1 rsyslog-module-pgsql-5.10.0-6.7.1 rsyslog-module-pgsql-debuginfo-5.10.0-6.7.1 rsyslog-module-relp-5.10.0-6.7.1 rsyslog-module-relp-debuginfo-5.10.0-6.7.1 rsyslog-module-snmp-5.10.0-6.7.1 rsyslog-module-snmp-debuginfo-5.10.0-6.7.1 rsyslog-module-udpspoof-5.10.0-6.7.1 rsyslog-module-udpspoof-debuginfo-5.10.0-6.7.1 References: https://bugzilla.novell.com/753077 https://bugzilla.novell.com/778769