Release Notes

syslog-ng Open Source Edition 3.17

Release Notes

August 2018

These release notes provide information about the syslog-ng Open Source Edition release.

Supported platforms

The syslog-ng Open Source Edition application is highly portable and is known to run on a wide range of hardware architectures (x86, x86_64, SUN Sparc, PowerPC 32 and 64, Alpha) and operating systems, including Linux, BSD, Solaris, IBM AIX, HP-UX, Mac OS X, Cygwin, Tru64, and others.

• The source code of syslog-ng Open Source Edition is released under the GPLv2 license and is available on GitHub.

• See the list of precompiled syslog-ng OSE binary packages.

New Features

What is new in syslog-ng Open Source Edition 3.17?

Version 3.17 of syslog-ng Open Source Edition includes the following main features.

linux-audit() source driver

A new source driver, linux-audit(), has been added. The linux-audit() source reads and automatically parses the Linux audit logs. For details, see Administration Guide.

exclude-kmsg() system source option

A new system source option, exclude-kmsg() makes it possible to avoid duplicate collection of kernel logs or errors in kernel log collection (for example, in scenarios where the log management on the host system and the containerized solution are collecting the kernel logs simultaneously). When set to yes, syslog-ng OSE will omit kernel logs on platforms where they are available separately. For details, see Administration Guide

SCL syntax updates

• You can now refer to any additional parameters at the end of the argument in a block by adding three dots to it (…). It tells syslog-ng OSE that this macro accepts `__VARARGS__`, therefore any name-value pair can be passed without validation. For details, see Administration Guide.

• You can now make parameters mandatory in block definitions by defining them with empty brackets (). For details, see Administration Guide.

Enhancements

• The failover() option allows you to specify what happens after syslog-ng OSE fails over to a secondary server. Additionally, the failover-servers() option has been deprecated and removed from the document. For more information about the failover() option, see Administration Guide.

• A note about JVM still running after deleting all Java destinations and reloading syslog-ng has been added to the description of Java destinations.

• The default value of the --skip-tokens parameter of the loggen application has been changed to 0. For details, see Administration Guide.

• Added support for the timestamp format used by Cisco Unified Call Manager in the Cisco Parser. For details, see the source code of this parser on GitHub.

Resolved Issues

For a detailed list of issues resolved in this release, see syslog-ng Releases page.