ABOUT
Archive for May, 2011
syslog-ng in Kindle
CzP has found out that syslog-ng is used in the Amazon Kindle. Seems like our userbase is in the millions. 
syslog-ng 3.3 feature freeze, 3.4 branch opened
With the recent maintenance policy updates in my last post, I plan quickly release a maintenance version for 3.2 (with version number 3.2.3) and then to concentrate on getting 3.3 into a stable form, starting with a beta release.
As a reminder, here are the new features of syslog-ng 3.3:
- performance improvements:
- new multi-threaded core that allows syslog-ng to scale into the hundred thousand message/sec range by using all the CPU cores available in the system
- use epoll() system call instead of traditional poll() (where available)
- transaction support in the SQL destination driver, resulting in significant performance improvements (not LOAD DATA though)
- buffered output for destination files at the cost of some latency
- other miscallenous changes the improve performance
- MongoDB destination driver with support for creating documents based on the dynamic syslog-ng message structure
- $(format-json) template function that converts messages into a JSON representation
- systemd support (which was backported to the 3.2 release as well to support distributions in their integration work on systemd)
As you can see, this release is clearly performance oriented, hopefully 3.4 will also come with new and exciting features. For now, I’ve opened the 3.4 branch in order to have a place where new stuff can go, instead of languishing as patches on the mailing list. I’m quite excited with the new threaded core, I see further opportunities, although I can hardly imagine someone with several hundred megabytes/sec of logs which the current core can deliver.
Also, the non-performance related items on the list above were contributed by members of the community, so by all means this release contains much more community work than previous ones. Thanks guys.
Maintenance Policy update for syslog-ng Open Source Editions
Dear syslog-ng users,
As discussed on the syslog-ng mailing list, the current versioning policies regarding syslog-ng Open Source Edition is confusing, and with the proliferation of syslog-ng versions, their maintenance is an increasing burden on the syslog-ng project. Currently three major versions are supported (3.0, 3.1 and 3.2) and a fourth one (3.3) is in active development.
A decision was made that the distinction between “feature” and “stable” releases for syslog-ng OSE releases will cease to exist: all releases will have the same status support-wise:
- they will be supported for a year, or
- until the next stable release is made
- whichever is longer
Also, the versioning of Open Source and Premium editions will become completely independent, and it is not possible to compare their functionality on the version number alone. The Premium Edition will always be based on a specific Open Source release, and provide additional functionality compared to the base version. OSE releases published after the PE release may provide additional functionality, not yet present in a PE release.
The changes above cause some of our currently supported versions to be deprecated. In order to provide a time window for migration to a newer release, the following EOL dates were set:
- syslog-ng 3.0: 30th, June 2011.
- syslog-ng 3.1: 30th, June 2011.
Everyone running these or earlier releases should upgrade to the latest 3.2.x release, which is currently at 3.2.2 (with 3.2.3 being prepared).
For more information:
- support periods for syslog-ng OSE versions:
http://www.balabit.com/network-security/syslog-ng/opensource-logging-system/support - to download the latest syslog-ng OSE sources:
http://www.balabit.com/network-security/syslog-ng/opensource-logging-system/downloads/upgrade
The syslog-ng project, on its own doesn’t provide syslog-ng binaries, except for a limited number of Linux distributions. It is expected that users compile syslog-ng on their own, or use the binary provided by the OS supplier.
This change doesn’t affect you, if
- you run a Premium Edition of syslog-ng,
- you have a support contract in place, that says otherwise
Happy Logging,
Bazsi