New rsyslog features to research/test

rsyslog_features_to_test.md

Misc rsyslog features to test/research

Various items from https://github.com/rsyslog/rsyslog/blob/v8-stable/ChangeLog

8.33.0

• config: add include() script object This permits to include files (like legacy $IncludeConfig) via a script object. Needless to say, the script object offers more features:

  • include files can now be
    • required, with rsyslog aborting when not present
    • required, with rsyslog emitting an error message but otherwise continuing when not present
    • optional, which means non-present include files will be skipped without notice This is controlled by the "mode" parameter.
  • text can be included form e.g. an environment variable --> ex: include(text=echo $ENVVAR) This finally really obsoletes $IncludeConfig. closes rsyslog/rsyslog#2151

• template: add option to generate json "container" This enables easy JSON generation via template. This commit also corrects an issue with the constant "jsonf" format. That was recently added, and the implementation problem only became visible when used inside a larger json object. No officially released code is affected, thought - so it rellay is just a side-note. closes rsyslog/rsyslog#2347

• core/template: add format jsonf to constant template entries closes rsyslog/rsyslog#2348

• config: add ability to disable config parameter ("config.enable") For auto-generated configs, it is useful to have the ability to disable some config constructs even though they may be specified inside the config. This can now be done via the config.disable parameter, applicable to all script objects. If set to on or not specified, the construct will be used, if set to any other value, it will be ignored. This can be used together with the backtick functionality to configure enable and disable from either a file or environment variable. closes rsyslog/rsyslog#2431

• script: permit to use environment variables during configuration new constant string type "backticks", inspired by sh (sample: echo $VARNAME).

• config optimizer: detect totally empty "if" statements and optimize them out

• template: constant entry can now also be formatted as json field This enhancements permits to craft clean templates that generate JSON, e.g. for ElasticSearch consumption (or any other REST API)

• core: set TZ on startup if not already set In theory, TZ should be set by the OS. Unfortuantely, this seems to be not the case any longer on many Linux distros. We now check it and set it appropriate if not already given. Thanks to github user JPvRiel for providing an excellent explanation of the reasoning for this and how to work around it. closes rsyslog/rsyslog#2054

8.32.0

• pmrfc3164: support for headerless messages pmrfc3164 now detects if the first non-SP, non-HT character is either '{' or '[' and if so assume that no header (TAG, HOSTNAME, DATE) is given. If so, it uses defaults for these values. The full message is used as the MSG part in that case. Note that an initial PRI may still be specified. This follows the trend to send JSON messages via syslog without any header. We use default header values in this case. This right now is a bit experimental; we may roll it back if problems show up in practice. closes rsyslog/rsyslog#2030

• core/action: new parameter "action.errorfile" permits to write failed messages to an "error file" so that they can be reviewed and potentially be reprocessed

• omfile: add module-global option "dynafile.donotsuspend" this permits to enable SUSPENDing dynafile actions. Traditionally, SUSPEND mode was never entered for dynafiles as it would have blocked overall processing flow. Default is not to suspend (and thus block). closes rsyslog/rsyslog#2236

• RainerScript: add function parse_json()

• RainerScript: add function substring()

• RainerScript: add function http_request()

• RainerScript: add function script_error() and error-reporting support This permits script functions that could fail to report errors back, so that the user can handle them if desired. We use an errno-style of interface. That means script_error() needs to be called after functions that supports it. It will return either 0 (all OK) or something else (an error condition). The commit also modifies the parse_time() function to use the new interface. First of all, this is useful for users, and secondly we needed a capability to craft a testbench test. closes rsyslog/rsyslog#1978

• rainerscript bugfix: ltrim() and rtrim function misadressing This could lead to a segfault and was triggerred by certain input data schemes. For example, a ltrim(" a") could lead to the fault.

As of the time this Gist entry was created, GitHub does not support notifications for comments for mentions to Gist entries (see isaacs/github#21 for details). Please contact me via Twitter or file an issue in the deoren/leave-feedback repo (created for that very purpose) if you wish to receive a response for your feedback. Thank you in advance!