4.23.0

AxoSyslog is binary-compatible with syslog-ng [1] and serves as a drop-in replacement.

We provide cloud-ready container images and Helm charts.

Packages are available in our APT and RPM repositories (Ubuntu, Debian, AlmaLinux, Fedora).

Check out the AxoSyslog documentation for all the details.

Features

• Memory queues: Reduced the amount of memory we use to store queued messages.

  Savings can be as much as 50%, or 8GB less memory use to represent
  1M messages (e.g. 8GB instead of 15GB, as measured by RSS).
  (#891)

• network()/syslog(): Added extended-key-usage-verify(yes) for TLS sources/destinations.
  (#907)

• FilterX: Added a new function called move().

  move() tells FilterX that the variable/expression specified as argument
  can be moved to its new location, instead of copying it.
  While FilterX optimizes most copies using its copy-on-write mechanism,
  some cases can be faster by telling it that the old location is not needed
  anymore. move() is equivalent to an unset() but is more explicit and
  returns the moved value, unlike unset().
  (#876)

• FilterX format_isodate() function: Added new function for datetime formatting.
  (#922)

• http: Added force-content-compression() option.

  Usage:

  destination {
    http(
      url("http://example.com/endpoint")
      content-compression("gzip")
      force-content-compression(yes)
    );
  }
  

  (#916)

• opentelemetry() source: Added ip() option to specify bind address.
  (#949)

Bugfixes

• FilterX dict and list: Fixed a potential crash when recursively inserting
  a dict or list instance into itself.
  (#891)

• FilterX parse_kv() function: Fixed improperly quoted key-value pair overwriting previous entry.
  (#921)

• json-parser(): Fixed parsing JSON array of string with comma.
  (#923)

• metrics: Made message memory usage metrics more accurate.

  AxoSyslog keeps track of memory usage by messages both globally and on
  a per queue basis. The accounting behind those metrics were inaccurate,
  the value shown being smaller than the actual memory use.
  These inaccuracies were fixed.
  (#889)

• internal() source: Fixed message loss during reload.
  (#944)

• network()/syslog(): Fix performance degradation around dynamic-window-size() when senders disconnect early.
  (#937)

• network()/syslog() sources: Fix a dynamic-window() crash on client disconnect while messages are pending.
  (#931)

• network()/syslog(): Fixed setting TLS-related macros, like ${.tls.x509_cn}, for the first message.
  (#911)

• config: Fixed a bug where @defines and environment variables were not substituted in SCL arguments
  in case those arguments were spread across multiple lines.
  (#920)

• parallelize(): Fix leaking messages and losing input window during reload.
  (#962)

Other changes

• http(): Added debug and notice level request logging for failed requests.
  (#928)

• FilterX repr() function: datetime representation now has microsecond resolution.

  Before:
  2000-01-01T00:00:00.000+00:00

  After:
  2000-01-01T00:00:00.000000+00:00
  (#919)

• Batching destinations: Added syslogng_output_batch_timedout_total metric.
  (#947)

• parallelize(): Added syslogng_parallelize_failed_events_total metric.
  (#924)

• metrics: Added a single syslogng_input_window_full_total on stats(level(1))

  It shows the total number of input window full events for the whole config.
  (#938)

[1] syslog-ng is a trademark of One Identity.

Discord

For a bit more interactive discussion, join our Discord server:

Credits

AxoSyslog is developed as a community project, and as such it relies
on volunteers, to do the work necessary to produce AxoSyslog.

Reporting bugs, testing changes, writing code or simply providing
feedback is an important contribution, so please if you are a user
of AxoSyslog, contribute.

We would like to thank the following people for their contribution:

Andras Mitzki, Attila Szakacs, Balazs Scheidler, Fᴀʙɪᴇɴ Wᴇʀɴʟɪ, Hofi,
László Várady, Peter Czanik (CzP), Romain Tartière, Szilard Parrag

AxoSyslog for Kubernetes

4.22.0

AxoSyslog is binary-compatible with syslog-ng [1] and serves as a drop-in replacement.

We provide cloud-ready container images and Helm charts.

Packages are available in our APT and RPM repositories (Ubuntu, Debian, AlmaLinux, Fedora).

Check out the AxoSyslog documentation for all the details.

Features

• FilterX in operator: Added support for dict keys for membership check.

  my_dict = {"foo": "foovalue", "bar": "barvalue"};
  my_needle = "foobar";
  
  if (my_needle in my_dict) {
    $MSG = "Found: " + my_dict[my_needle];
  } else {
    $MSG = "Not Found";
  };
  

  (#888)

Bugfixes

• parallelize(): Fixed occasional crashes on high load.
  (#904)

• parallelize(): Fixed unoptimized parallelization with more workers() than CPU cores.
  (#906)

• FilterX regexp_subst() function: Fixed capture group references in the replacement argument.

  In the case of global=true, the value of capture group references were always used from
  that of the first match, e.g. the 2nd and subseqent matches used an incorrect value.
  (#895)

• disk-buffer(): Fixed various bugs.

  • Fixed potential writes beyond the configured front-cache limit.
  • Fixed a possible issue where memory usage metrics could reset on reload.

  (#901)

Other changes

• disk-buffer(): Various smaller improvements and QoL features.

  • Added detailed debug logging for diskbuffer load and save operations,
    exposing the internal state of the non-reliable diskbuffer.
  • Improved front-cache balancing by enforcing the front-cache limit when
    distributing items between front-cache and front-cache-output.
  • Improved calculation of abandoned diskbuffer metrics by using existing
    file header data instead of loading the entire buffer file,
    significantly reducing reload time impact.

  (#901)
  (#902)

[1] syslog-ng is a trademark of One Identity.

Discord

For a bit more interactive discussion, join our Discord server:

Credits

AxoSyslog is developed as a community project, and as such it relies
on volunteers, to do the work necessary to produce AxoSyslog.

Reporting bugs, testing changes, writing code or simply providing
feedback is an important contribution, so please if you are a user
of AxoSyslog, contribute.

We would like to thank the following people for their contribution:

Andras Mitzki, Attila Szakacs, Balazs Scheidler,
BenBryzak-brisbaneqldgovau, László Várady, Szilard Parrag, shifter

4.21.0

AxoSyslog is binary-compatible with syslog-ng [1] and serves as a drop-in replacement.

We provide cloud-ready container images and Helm charts.

Packages are available in our APT and RPM repositories (Ubuntu, Debian, AlmaLinux, Fedora).

Check out the AxoSyslog documentation for all the details.

Features

• format_syslog_5424(): Added new FilterX function for syslog formatting

  Usage:

  format_syslog_5424(
    message,
    add_octet_count=false,
    pri=expr,
    timestamp=expr,
    host=expr,
    program=expr,
    pid=expr,
    msgid=expr
  )
  

  message is the only mandatory argument.

  Fallback values will be used instead of the named arguments
  if they are not set, or their evaluation fails.
  (#875)

• http() and other threaded destinations: add worker-partition-autoscaling(yes)

  When worker-partition-key() is used to categorize messages into different batches,
  the messages are - by default - hashed into workers, which prevents them from being distributed across workers
  efficiently, based on load.

  The new worker-partition-autoscaling(yes) option uses a 1-minute statistic to help distribute
  high-traffic partitions among multiple workers, allowing each worker to maximize its batch size.

  When using this autoscaling option, it is recommended to oversize the number of workers: set it higher than the
  expected number of partitions.
  (#855)

• network(): add transport(nul-terminated) to support NULL characters to separate log records instead of the
  more traditional newline separated format
  (#867)

• New metrics: syslogng_output_workers and syslogng_output_active_worker_partitions

  Using the new worker-partition-autoscaling(yes) option allows producing partition metrics, which can be used
  for alerting: if the number of active partitions remains higher than the configured number of workers,
  it may indicate that events are not being batched properly, which can lead to performance degradation.
  (#866)

Bugfixes

• FilterX parse_csv(): fix crash
  (#879)

• FilterX metrics_labels(): fix += operator
  (#878)

• disk-buffer(): fix memory leaks
  (#872)

Other changes

• disk-buffer(): significant performance improvements for the non-reliable disk buffer
  (#857)

• Performance improvements for memory queues
  (#881)

[1] syslog-ng is a trademark of One Identity.

Discord

For a bit more interactive discussion, join our Discord server:

Credits

AxoSyslog is developed as a community project, and as such it relies
on volunteers, to do the work necessary to produce AxoSyslog.

Reporting bugs, testing changes, writing code or simply providing
feedback is an important contribution, so please if you are a user
of AxoSyslog, contribute.

We would like to thank the following people for their contribution:

Andras Mitzki, Attila Szakacs, Balazs Scheidler, László Várady, Szilard Parrag,
Tamás Kosztyu, shifter

4.20.1

This is a hotfix release that fixes a rare metric race condition causing a reload time crash.

AxoSyslog is binary-compatible with syslog-ng [1] and serves as a drop-in replacement.

We provide cloud-ready container images and Helm charts.

Packages are available in our APT and RPM repositories (Ubuntu, Debian, AlmaLinux, Fedora).

Check out the AxoSyslog documentation for all the details.

Features

• Added new metrics

  • syslogng_window_capacity and syslogng_window_available on stats(level(3)).
    • Shows the log-iw-size() value and the current state of the source window, respectively.
  • syslogng_window_full_total
    • Tracks how many times the window was completely full. This counter will
      increase any time the destination causes the source to be throttled.
  • syslogng_memory_queue_processed_events_total and syslogng_disk_queue_processed_events_total
    • Counts the number of events processed since startup by each queue.
  • syslogng_output_batch_size_..., syslogng_output_event_size_..., syslogng_output_request_latency_...
    • histogram style metrics for http(), otel() and other threaded destinations

  (#823)
  (#824)
  (#845)

• clickhouse() destination: Added JSONCompactEachRow format and new format directive

  This update enhances the ClickHouse destination by adding support for the JSONCompactEachRow
  format and introducing a new format directive for explicitly selecting the data format.

  Background
  Previously, the destination supported:

  • Protobuf (default when using proto-var)
  • JSONEachRow (default when using json-var)

  These defaults remain unchanged.

  What’s new

  • Added support for JSONCompactEachRow — a more compact, array-based JSON representation (used with json-var).
  • Introduced the format directive, allowing manual selection of the desired format:
    • JSONEachRow
    • JSONCompactEachRow
    • Protobuf

  Example

  destination {
    clickhouse (
      ...
      json-var(json("$my_filterx_json_var"))
      format("JSONCompactEachRow")
      ...
    );
  };

  JSONEachRow (each JSON object per line, more readable):

  {"id":1,"name":"foo","value":42}
  {"id":2,"name":"bar","value":17}
  

  JSONCompactEachRow (compact array-based row representation):

  [1,"foo",42]
  [2,"bar",17]
  

  Validation and error handling

  Invalid format values now produce:

  Error parsing within destination: invalid format value 'invalid format', possible values:[JSONEachRow, JSONCompactEachRow, Protobuf]
  

  If the data’s actual format doesn’t match the selected format, ClickHouse returns:

  CANNOT_PARSE_INPUT_ASSERTION_FAILED
  

  (#828)

• opentelemetry() source: Added keep-alive() option

  With this new option, client connections can be kept alive during reload,
  avoiding unnecessary retry backoffs and other error messages on the client
  side.

  The default is yes.

  (#832)

• s3() destination: Added new object_key_suffix() option

  The default suffix is an empty string, to ensure backward compatibility.
  (#797)

• http() and other threaded destinations: add worker-partition-buckets() option

  This allows the same worker-partition-key() to use multiple worker threads.
  (#852)

Bugfixes

• metrics: Fixed a rare race condition in dynamic metrics.
  (#858)

• filterx: Fixed various memory leaks
  (#829)
  (#836)
  (#842)

• filterx: Fixed a variable synchronization bug.
  (#849)

• filterx otel_logrecord(): Fixed not clearing body before setting dict and array values.
  (#835)

• Fixed keep-alive() during config reload revert
  (#831)

• http() destination: Fixed batch partitioning in case of templated body-prefix()
  (#843)

• s3: Bugfixes and general stability improvements for the s3 destination driver

  • Fixed a major bug causing data loss if multithreaded upload was enabled via the upload-threads option.
  • Fixed a bug where in certain conditions finished object buffers would fail to upload.
  • Fixed a bug, where empty chunks were being uploaded, causing errors.

  (#797)
  (#846)

• filterx: fix potential use-after-free crashes
  (#854)

• disk-buffer(): fix memory leak when worker-partition-key() and disk-buffer() are used together
  (#853)

Other changes

• Improved reload time for large configurations.
  (#844)

[1] syslog-ng is a trademark of One Identity.

Discord

For a bit more interactive discussion, join our Discord server:

Credits

AxoSyslog is developed as a community project, and as such it relies
on volunteers, to do the work necessary to produce AxoSyslog.

Reporting bugs, testing changes, writing code or simply providing
feedback is an important contribution, so please if you are a user
of AxoSyslog, contribute.

We would like to thank the following people for their contribution:

Andras Mitzki, Attila Szakacs, Balazs Scheidler, Bálint Horváth,
László Várady, Szilard Parrag, Tamás Kosztyu, shifter

4.20.0

AxoSyslog is binary-compatible with syslog-ng [1] and serves as a drop-in replacement.

We provide cloud-ready container images and Helm charts.

Packages are available in our APT and RPM repositories (Ubuntu, Debian, AlmaLinux, Fedora).

Check out the AxoSyslog documentation for all the details.

Features

• Added new metrics

  • syslogng_window_capacity and syslogng_window_available on stats(level(3)).
    • Shows the log-iw-size() value and the current state of the source window, respectively.
  • syslogng_window_full_total
    • Tracks how many times the window was completely full. This counter will
      increase any time the destination causes the source to be throttled.
  • syslogng_memory_queue_processed_events_total and syslogng_disk_queue_processed_events_total
    • Counts the number of events processed since startup by each queue.
  • syslogng_output_batch_size_..., syslogng_output_event_size_..., syslogng_output_request_latency_...
    • histogram style metrics for http(), otel() and other threaded destinations

  (#823)
  (#824)
  (#845)

• clickhouse() destination: Added JSONCompactEachRow format and new format directive

  This update enhances the ClickHouse destination by adding support for the JSONCompactEachRow
  format and introducing a new format directive for explicitly selecting the data format.

  Background
  Previously, the destination supported:

  • Protobuf (default when using proto-var)
  • JSONEachRow (default when using json-var)

  These defaults remain unchanged.

  What’s new

  • Added support for JSONCompactEachRow — a more compact, array-based JSON representation (used with json-var).
  • Introduced the format directive, allowing manual selection of the desired format:
    • JSONEachRow
    • JSONCompactEachRow
    • Protobuf

  Example

  destination {
    clickhouse (
      ...
      json-var(json("$my_filterx_json_var"))
      format("JSONCompactEachRow")
      ...
    );
  };

  JSONEachRow (each JSON object per line, more readable):

  {"id":1,"name":"foo","value":42}
  {"id":2,"name":"bar","value":17}
  

  JSONCompactEachRow (compact array-based row representation):

  [1,"foo",42]
  [2,"bar",17]
  

  Validation and error handling

  Invalid format values now produce:

  Error parsing within destination: invalid format value 'invalid format', possible values:[JSONEachRow, JSONCompactEachRow, Protobuf]
  

  If the data’s actual format doesn’t match the selected format, ClickHouse returns:

  CANNOT_PARSE_INPUT_ASSERTION_FAILED
  

  (#828)

• opentelemetry() source: Added keep-alive() option

  With this new option, client connections can be kept alive during reload,
  avoiding unnecessary retry backoffs and other error messages on the client
  side.

  The default is yes.

  (#832)

• s3() destination: Added new object_key_suffix() option

  The default suffix is an empty string, to ensure backward compatibility.
  (#797)

• http() and other threaded destinations: add worker-partition-buckets() option

  This allows the same worker-partition-key() to use multiple worker threads.
  (#852)

Bugfixes

• filterx: Fixed various memory leaks
  (#829)
  (#836)
  (#842)

• filterx: Fixed a variable synchronization bug.
  (#849)

• filterx otel_logrecord(): Fixed not clearing body before setting dict and array values.
  (#835)

• Fixed keep-alive() during config reload revert
  (#831)

• http() destination: Fixed batch partitioning in case of templated body-prefix()
  (#843)

• s3: Bugfixes and general stability improvements for the s3 destination driver

  • Fixed a major bug causing data loss if multithreaded upload was enabled via the upload-threads option.
  • Fixed a bug where in certain conditions finished object buffers would fail to upload.
  • Fixed a bug, where empty chunks were being uploaded, causing errors.

  (#797)
  (#846)

• filterx: fix potential use-after-free crashes
  (#854)

• disk-buffer(): fix memory leak when worker-partition-key() and disk-buffer() are used together
  (#853)

Other changes

• Improved reload time for large configurations.
  (#844)

[1] syslog-ng is a trademark of One Identity.

Discord

For a bit more interactive discussion, join our Discord server:

Credits

AxoSyslog is developed as a community project, and as such it relies
on volunteers, to do the work necessary to produce AxoSyslog.

Reporting bugs, testing changes, writing code or simply providing
feedback is an important contribution, so please if you are a user
of AxoSyslog, contribute.

We would like to thank the following people for their contribution:

Andras Mitzki, Attila Szakacs, Balazs Scheidler, Bálint Horváth,
László Várady, Szilard Parrag, Tamás Kosztyu, shifter

4.19.1

This is a hotfix release that fixes a config reload time memory leak

AxoSyslog is binary-compatible with syslog-ng [1] and serves as a drop-in replacement.

We provide cloud-ready container images and Helm charts.

Packages are available in our APT and RPM repositories (Ubuntu, Debian, AlmaLinux, Fedora).

Check out the AxoSyslog documentation for all the details.

Bugfixes

• filterx: Fixed a memory leak that occurs during reloads.
  (#827)

[1] syslog-ng is a trademark of One Identity.

Discord

For a bit more interactive discussion, join our Discord server:

Credits

AxoSyslog is developed as a community project, and as such it relies
on volunteers, to do the work necessary to produce AxoSyslog.

Reporting bugs, testing changes, writing code or simply providing
feedback is an important contribution, so please if you are a user
of AxoSyslog, contribute.

We would like to thank the following people for their contribution:

Andras Mitzki, Attila Szakacs, Balazs Scheidler, László Várady,
Szilard Parrag, Tamás Kosztyu, shifter

4.19.0

AxoSyslog is binary-compatible with syslog-ng [1] and serves as a drop-in replacement.

We provide cloud-ready container images and Helm charts.

Packages are available in our APT and RPM repositories (Ubuntu, Debian, AlmaLinux, Fedora).

Check out the AxoSyslog documentation for all the details.

Features

• dict_to_pairs() FilterX function: Added a new function to convert dicts to list of pairs

  Example usage:

  dict = {
      "value_1": "foo",
      "value_2": "bar",
      "value_3": ["baz", "bax"],
  };
  
  list = dict_to_pairs(dict, "key", "value");
  # Becomes:
  # [
  #   {"key":"value_1","value":"foo"},
  #   {"key":"value_2","value":"bar"},
  #   {"key":"value_3","value":["baz","bax"]}
  # ]
  

  (#810)

Bugfixes

• syslogng_output_unreachable metric: fix marking destinations unreachable during reload
  (#818)

• transport(proxied-tcp): Fix a HAProxy protocol v2 parsing issue that
  caused a failed assertion. This essentially triggers a crash with a SIGABRT
  whenever a "LOCAL" command was sent in the HAProxy header without address
  information.
  (#814)

• filterx: fix parse_csv function crash if coulumns specified non-existent variable
  (#819)

• opentelemetry() source: fix various crashes during startup/reload
  (#822)

[1] syslog-ng is a trademark of One Identity.

Discord

For a bit more interactive discussion, join our Discord server:

Credits

AxoSyslog is developed as a community project, and as such it relies
on volunteers, to do the work necessary to produce AxoSyslog.

Reporting bugs, testing changes, writing code or simply providing
feedback is an important contribution, so please if you are a user
of AxoSyslog, contribute.

We would like to thank the following people for their contribution:

Andras Mitzki, Attila Szakacs, Balazs Scheidler, László Várady,
Szilard Parrag, Tamás Kosztyu, shifter

4.18.1

AxoSyslog is binary-compatible with syslog-ng [1] and serves as a drop-in replacement.

We provide cloud-ready container images and Helm charts.

Packages are available in our APT and RPM repositories (Ubuntu, Debian, AlmaLinux, Fedora).

Check out the AxoSyslog documentation for all the details.

Bugfixes

• strftime() FilterX function: Fixed %Z formatting for some rare cases

  America/Caracas (-04:30) time offset will now be correctly formatted.
  (#811)

• disk-buffer(): fix getting stuck under rare circumstances
  (#813)

• disk-buffer(): do not allow flow-control misconfiguration
  The flow-control-window_size() (formerly mem-buf-length()) option is now deprecated and no longer has any
  effect.
  (#813)

[1] syslog-ng is a trademark of One Identity.

Discord

For a bit more interactive discussion, join our Discord server:

Credits

AxoSyslog is developed as a community project, and as such it relies
on volunteers, to do the work necessary to produce AxoSyslog.

Reporting bugs, testing changes, writing code or simply providing
feedback is an important contribution, so please if you are a user
of AxoSyslog, contribute.

We would like to thank the following people for their contribution:

Andras Mitzki, Attila Szakacs, Balazs Scheidler, Hofi, László Várady,
Szilard Parrag, Tamás Kosztyu, shifter

4.18.0

AxoSyslog is binary-compatible with syslog-ng [1] and serves as a drop-in replacement.

We provide cloud-ready container images and Helm charts.

Packages are available in our APT and RPM repositories (Ubuntu, Debian, AlmaLinux, Fedora).

Check out the AxoSyslog documentation for all the details.

Features

• http(): Added support for templated headers()

  In case of batching the templates in headers() will be calculated
  from the first message. Make sure to use worker-partition-key() to
  group similar messages together.

  Literal dollar signs ($) used in headers() must be escaped like $$.
  (#794)

• FilterX: unary + and - operators

  Useful for dynamic string slicing, for example:

  str[..-tempvar]
  

  (#788)

• FilterX parse_csv(): add quote_pairs parameter

  For example:

  filterx {
    str = "sarga,[bogre],'gorbe'";
    $MSG = parse_csv(str, quote_pairs=["[]", "'"]);
  };
  

  (#804)

Bugfixes

• FilterX in operator: fix crash when left- or right-hand side operand evaluation fails
  (#798)

• in FilterX operator: Fixed finding message_values in arrays.
  (#791)

• python(): LogTemplate::format() now returns a bytes object

  In the Python bindings, LogMessage is not UTF-8 or Unicode–safe by default.
  This means developers must explicitly call decode() on message fields and handle any decoding errors themselves.

  Since LogTemplate operates on LogMessage fields, this behavior also applies to it.

  Breaking change:
  When using templates, you now need to decode the result manually. For example:
  format().decode("utf-8", errors="backslashreplace")
  (#799)

• in FilterX operator: Fixed possible memory corruption regarding unreferencing an operand.
  (#792)

[1] syslog-ng is a trademark of One Identity.

Discord

For a bit more interactive discussion, join our Discord server:

Credits

AxoSyslog is developed as a community project, and as such it relies
on volunteers, to do the work necessary to produce AxoSyslog.

Reporting bugs, testing changes, writing code or simply providing
feedback is an important contribution, so please if you are a user
of AxoSyslog, contribute.

We would like to thank the following people for their contribution:

Andras Mitzki, Attila Szakacs, Balazs Scheidler, Hofi, László Várady,
Szilard Parrag, Tamás Kosztyu, shifter