Why: the changed-file output was being expanded as a raw shell string,
which can break on paths with spaces or leading dashes.
Impact: yamllint now receives the changed YAML paths as proper quoted
arguments.
Before/After: before the workflow interpolated `all_changed_files`
directly into the shell command; after it reads newline-separated paths
into an array and passes them safely.
Technical Overview:
Configure `tj-actions/changed-files` to emit newline-separated paths.
Use `mapfile` in the lint step and invoke yamllint with the resulting
quoted array.
With the help of AI-Agents: Codex
Why: the inline yamllint override itself exceeded the new 120-character
limit and triggered the warning this branch is trying to address.
Impact: the workflow keeps the 120-character override without linting
itself.
Before/After: before the new override line was 123 characters; after it
is split across shell continuation lines.
Technical Overview:
Rewrite the yamllint invocation in the workflow as a multi-line shell
command while keeping the same inline config.
With the help of AI-Agents: Codex
Why: the default relaxed profile still warns on lines longer than 80
characters, which is too short for some workflow and YAML content.
Impact: yamllint will now allow lines up to 120 characters before
warning.
Before/After: before yamllint warned at 80 characters even in relaxed
mode; after the line-length rule is capped at 120.
Technical Overview:
Keep the workflow on the relaxed yamllint profile and override only
the line-length maximum in the inline configuration string.
With the help of AI-Agents: Codex
Why: rsyslog CI already covers generic quality well, but it lacked
repository-specific policy checks in a few recurring areas.
Impact: pull requests now get a focused deterministic policy check
for test registration, doc distribution sync, and new-module
onboarding.
Before/After: before these repository rules depended on reviewer
memory; after CI checks them directly and reports all findings in one
run.
Technical Overview:
Add a dedicated workflow that only triggers for policy-relevant
changes and builds a focused review package from the pull-request
diff.
Evaluate the focused checks deterministically for tests, docs, and
new modules, then normalize the results into a workflow summary.
Fail the workflow only for deterministic policy violations, while
still printing advisory warnings so contributors can address all
follow-up in one iteration.
With the help of AI-Agents: Codex
Why:
Mermaid diagrams fail on GitHub Pages PR previews and when opening
built HTML via file://. ES module imports use wrong paths and CORS
blocks file://. Two build paths (build/ vs build/html/) caused
confusion and inconsistent fix application.
Impact:
Doc build output path unified; Mermaid diagrams render in offline,
online, and RPM builds.
Before/After:
Before: Diagrams broken on pr-N previews and file://; two output
paths. After: Single build/ path; diagrams work everywhere.
Technical Overview:
- conf.py: Simplify sphinxcontrib-mermaid monkey-patch; force
Dagre renderer; improve UMD/file:// comments.
- fix-mermaid-offline.py: Remove ELK script first (regex order fix);
add inline ESM import handling for HTTP; compute _static path per
file depth.
- Makefile, inside_docker, CI: Switch -M html to -b html; output
to build/ instead of build/html/.
- build_rag_db.py: Use build/.doctrees for -b html.
- doc_build.yml: Add conf.py and fix-mermaid-offline.py to
changed-files; update artifact paths to doc/build.
Fixes: https://github.com/rsyslog/rsyslog/issues/6620
Why:
Align CI with current Rocky Linux and EPEL versions for ongoing
support and security.
Impact:
RPM build job and mock defaults now target EL9; artifact names change.
Before/After:
Before: Rocky Linux 8 container, epel-8 repo, powertools, epel-8-x86_64.
After: Rocky Linux 9 container, epel-9 repo, crb, epel-9-x86_64.
Technical Overview:
- .github/workflows/run_checks.yml: Use quay.io/rockylinux/rockylinux:9
and EPEL-9 baseurl; enable crb instead of powertools; set artifact
name to rpms-epel-9-x86_64.
- devtools/run-rpm-build.sh: Default MOCK_CONFIG to epel-9-x86_64 so
local/CI runs match the new environment.
Why
Native post-quantum TLS support should be usable and testable on newer
distro baselines without adding provider-mode compatibility work for
older platforms.
Impact
Rsyslog now has native-PQ smoke tests, clearer TLS diagnostics, updated
CI baselines and helper images, and a new post-quantum tutorial for
supported distros.
Before/After
Before: Fedora CI still targeted Fedora 41, PQ-capable TLS settings had
no dedicated rsyslog tests or user-facing tutorial, and stricter clang
builds could fail on warning-group handling.
After: CI targets Fedora 43, native PQ usage is documented and smoke-
tested, helper images include the required tools, and the branch builds
and tests cleanly with the newer compiler/container combinations.
Technical Overview
The CI matrix now replaces the Fedora 41 lane with Fedora 43 and adds a
matching Fedora 43 development image.
The Debian 13 and Fedora 43 development containers now install the
GnuTLS CLI utilities needed for native PQ capability checks.
The OpenSSL TLS config path logs clearer messages when a command or
value is unavailable on the native OpenSSL build.
The GnuTLS TLS config path reports unsupported priority-string options
more explicitly.
Two new shell tests add native PQ smoke coverage for OpenSSL and GnuTLS
using the existing gnutlsPriorityString control surface.
Those tests self-skip unless the local native TLS libraries expose the
required hybrid group support.
The imtcp parameter docs and omfwd docs now explain the native-only PQ
support policy and include example configurations.
A new tutorial documents native PQ usage for OpenSSL and GnuTLS on
supported newer distro versions.
The shared runtime warning policy in rsyslog.h now tolerates clang
handling of unknown warning groups so older and newer clang lanes remain
warning-free under the existing finalize_it error-handling pattern.
Testbench follow-ups harden omfwd-lb-susp with isolated retry attempts,
skip rcvr_fail_restore on ARM where it is timing-flaky, and keep local
SC2181 suppressions where if-exec rewrites would reduce shell-script
usability.
The Fedora 43 Dockerfile now cleans the dnf cache after install and
locally suppresses the non-useful DL3041 package-version pinning warning.
Older distro versions remain intentionally unsupported for PQ in this
phase because we expect users to move to newer baselines first.
If there is demand later, older-version support can be considered in a
separate effort.
With the help of AI-Agents: Codex
Why
Ensure GitHub code owner review applies consistently to repository
metadata, CI, build tooling, and the default source tree.
Impact
Security-sensitive paths now require review from the listed
maintainers when branch protection enforces code owner approval.
Before/After
Before: only workflow files named a single owner.
After: metadata, CI, build tooling, and all other paths map to both
maintainers.
Technical Overview
Expand `.github/CODEOWNERS` from workflow-specific entries to a
small explicit rule set.
Add root rules for `.gitmodules` and `.gitattributes`.
Replace the separate workflow globs with a single
`.github/workflows/*` rule.
Add ownership for `autogen.sh`, `configure.ac`, `Makefile.am`, and
`devtools/` to cover build and release tooling.
Add a final `*` rule so the core source tree and remaining repository
paths are owned by the maintainers.
With the help of AI-Agents: Codex
Why:
Broken local links in generated docs can slip through Sphinx success and
only surface after deployment.
Impact:
Docs CI now fails on invalid generated local links and missing anchors.
Before/After:
Before, docs CI built HTML but did not reliably validate generated links.
After, docs CI runs deterministic HTML link checks on built output.
Technical Overview:
Add doc/tools/check-html-links.py to parse generated HTML and validate
local href/src/srcset targets deterministically.
Support base href resolution to match browser-local URL resolution.
Validate optional fragment anchors using id/name lookup.
Decode percent-encoded URL paths before filesystem target checks.
Guard against paths that escape the build root after normalization.
Update doc_build workflow to run the checker after Sphinx HTML build.
Use the HTML output root (doc-builder/doc/build/html) for correct
root-absolute link validation behavior.
With the help of AI-Agents: codex
This prevents documentation deployment workflows from running on forks,
saving GitHub Actions minutes and reducing noise for contributors.
The workflow will now only execute when the repository is
'rsyslog/rsyslog'.
AddressSanitizer by default sets disable_coredump=1, which prevents
core file generation even when abort() is called. This commit adds
disable_coredump=0 to ASAN_OPTIONS in both macOS and ARM64 workflows
to ensure core dumps are generated on crashes.
This allows diag.sh to find and analyze core files for better
debugging of test failures in ASAN-enabled CI jobs.
Affected workflows:
- macOS CI (ASAN builds)
- ARM64 CI (native ASAN builds)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sitemap uses DOC_BASE_URL/doc/sitemap.xml when the repository
variable is set; otherwise falls back to the github.io URL for forks.
Technical overview:
- Add DOC_BASE_URL env to the Prepare Pages step (from vars.DOC_BASE_URL).
- Introduce DEFAULT_BASE from github.repository for backward compatibility.
- BASE="${DOC_BASE_URL:-$DEFAULT_BASE}" selects override or fallback.
- Document the variable in the workflow header comment.
- No change to build artifact layout or deployment flow.
Impact: Doc build succeeds with release_type=dev from env; deploy runs
only on push to main.
Before: Env override with release_type=dev hit NameError in html_title
block; deploy ran on main, master, and pr/publish-doc.
After: release_string_detail set when release_type=dev; deploy on main.
Technical Overview:
- doc/source/conf.py: Set release_string_detail = 'simple' when
release_type == 'dev' in the env override block so html_title and
epub blocks no longer reference an undefined variable.
- doc_deploy_main.yml: Replace branches with [main] (drop master and
pr/publish-doc).
Why: Enable automated deployment of rsyslog documentation to GitHub
Pages with Google Analytics, using the same build setup as production.
Impact: New workflow, build script, and Docker image updates; removes
cleanup_pr_preview job from doc_build.yml.
Before: Documentation deploy was manual; PR preview folders lingered
on gh-pages after PR close.
After: Push to main triggers build and deploy to /doc/ with GA; root
redirects to /doc/; robots.txt restricts crawling to /doc/ only;
PR preview cleanup removed in favor of Pages artifact deploy.
Technical Overview:
- Add .github/workflows/doc_deploy_main.yml: triggers on push to main,
master, pr/publish-doc or workflow_dispatch; builds in Docker with
rsyslog_dev_doc_base_ubuntu:22.04; deploys under /doc/ via
upload-pages-artifact; runs container as -u "$(id -u):$(id -g)";
adds root index.html redirect, robots.txt (Allow /doc/, Sitemap).
- Add doc/tools/inside_docker_doc_html.sh: uses pre-built venv from
image; sets RSYSLOG_DOC_VERSION/RSYSLOG_DOC_RELEASE_TYPE; runs
sphinx-build with Furo/sitemap; applies Mermaid fix.
- doc/source/conf.py: support RSYSLOG_DOC_VERSION and
RSYSLOG_DOC_RELEASE_TYPE env vars; format rst_prolog for non-git
builds; use release_type in release string (Gemini feedback).
- Add doc/tools/pages-root-index.html (redirect / to /doc/),
doc/tools/pages-robots.txt (Allow /doc/, Disallow /, Sitemap).
- packaging/docker/dev_env/ubuntu/doc_base/22.04: add python3-venv;
pre-build /opt/rsyslog-doc-venv from doc/requirements.txt; build.sh
runs from repo root for COPY.
- doc/Makefile.am: add inside_docker_doc_html.sh, pages-root-index.html,
pages-robots.txt to EXTRA_DIST.
- doc_build.yml: remove cleanup_pr_preview job.
Requires GOOGLE_ANALYTICS_ID repository secret.
* build: default-enable impstats-push and align CI containers
Enable impstats-push by default and keep configure strict when dependencies are missing.
Update CI/container definitions for distro differences (CentOS/OpenEuler/Ubuntu and workflow overrides), add explicit --disable-impstats-push where impstats is disabled, and fix impstats protobuf generation for distcheck/VPATH builds.
Why:
Enable CI validation on ARM architectures so platform-specific regressions
are caught before merge. arm64 uses native GitHub runners; armhf uses QEMU
because GitHub does not offer 32-bit ARM runners. Network namespace tests may
fail under QEMU where the mount syscall is not properly emulated.
Impact:
- New arm_CI job runs on armhf and arm64 when relevant files change.
- arm64 uses native ubuntu-24.04-arm runner; armhf uses QEMU on x64.
- Netns tests skip gracefully (exit 77) if ip netns add fails.
Before:
- No ARM CI; netns tests could fail with cryptic errors under QEMU.
After:
- arm_CI: armhf (QEMU, reduced test set) and arm64 (native, expanded tests, ASan).
- require_netns_capable() in diag.sh; netns tests call it and skip when unavailable.
- ratelimit double-free fixed in ratelimit.c.
- skip_ASAN() in diag.sh; empty-hostname, omfile-read-only* skip when ASan enabled
(LD_PRELOAD/read-only behavior conflicts).
Technical Overview:
- Add arm_CI job to run_checks.yml: matrix over armhf/arm64. armhf:
runs-on ubuntu-24.04, QEMU + Docker Buildx, reduced configure (disable-default-tests,
many modules disabled). arm64: runs-on ubuntu-24.04-arm (native), expanded
configure (default tests, gnutls, relp, imfile, etc.). Conditional QEMU
setup only for armhf.
- Add devtools/ci/Dockerfile.arm: Ubuntu 24.04 with build tools, gnutls,
libestr, libfastjson, zlib, iproute2, libgcrypt, librelp, uuid, libyaml
(for arm64 expanded build).
- Add require_netns_capable() to diag.sh; use in imtcp-netns.sh,
uxsock_multiple_netns.sh, tcp_forwarding_ns_tpl.sh.
- Add skip_ASAN() to diag.sh; use in empty-hostname.sh, omfile-read-only.sh,
omfile-read-only-errmsg.sh.
- Add devtools/ci/Dockerfile.arm to arm_CI changed-files filter.
- Quote $GITHUB_OUTPUT and $GITHUB_STEP_SUMMARY in clang static analyzer steps.
- Fix double-free in ratelimit.c: shared->name is the hashtable key, freed by
hashtable_destroy; remove redundant free(shared->name) in ratelimitFreeShared.
Why
VictoriaLogs jsonline is a target deployment path for omhttp users and
we need a direct integration signal in PR CI.
Impact
Adds a real-container omhttp->VictoriaLogs validation path and a scoped
CI job for relevant PRs.
Before/After
Before: no CI test validated omhttp against VictoriaLogs jsonline.
After: PRs touching omhttp or this test run a minimal live integration
check.
Technical Overview
Add tests/omhttp-victorialogs-jsonline.sh to send batched newline JSONL
payloads with omhttp to /insert/jsonline and verify indexed results via
/select/logsql/query.
Use jsonf list templating and a per-run marker to isolate records during
query validation. Keep transport on plain HTTP for CI simplicity.
Register the test in tests/Makefile.am under TESTS_OMHTTP so it is part
of testbench distribution and invocable as a single .log target.
Add a new run_checks.yml job named victorialogs_CI that starts a
VictoriaLogs service container, runs only
omhttp-victorialogs-jsonline.log, and gates execution with changed-files
filters for the test, omhttp components, and the workflow itself.
With the help of AI-Agents: Codex (GPT-5)
Move standalone PR workflows into .github/workflows/run_checks.yml so compile acts as the common gate for downstream CI jobs.
This ensures macOS, journal, codecov (base/kafka), elasticsearch, clang analyzer, and kafka distcheck do not run when the initial compile matrix fails.
Also align changed-files logic to avoid broad workflow globs and let non-compile jobs ignore doc/Makefile.am, while compile intentionally keeps doc/Makefile.am in scope to satisfy branch-protection expectations.
Adds first-class integration with VictoriaMetrics to simplify ops
dashboards and move toward project-supported telemetry without
sidecar collectors.
Impact: New optional feature (off by default). No behavior change
unless configured via push.* parameters.
Before: impstats could only log locally or emit text formats.
After: impstats can push counters to Prometheus-compatible endpoints.
Technical: implement a native Prometheus Remote Write path in
impstats, encoding counters to protobuf and compressing with snappy
over HTTP via libcurl. Replace interim text parsing with a new
statsobj v14 API (GetAllCounters) that iterates raw uint64 counters,
keeps atomic reads for IntCtr and best-effort reads for Int. Add
metric builder with Prometheus-compliant sanitization and the naming
pattern <origin>_<name>_<counter>_total. Provide TLS knobs (CA, mTLS,
insecureSkipVerify), static/dynamic labels, timeout, and optional
batching by bytes/series. Build is gated behind
--enable-impstats-push with protobuf-c/snappy/curl checks. Ship docs,
basic/VM integration tests, and a GitHub Actions workflow using a
VictoriaMetrics service; TSAN jobs disable impstats-push.
Configuration: push.url, push.labels, push.timeout.ms,
push.label.{instance,job,origin,name}, push.tls.{cafile,certfile,
keyfile,insecureSkipVerify}, push.batch.{maxBytes,maxSeries}.
With the Help of AI Agents: ChatGPT codex 5.2
* CI: enable run_checks for forks & secure workflows
Previously, the `run_checks` workflow was restricted to run only
for PRs originating from the same repository. This prevented
integration tests from running on PRs submitted from forks.
This change enables `run_checks` for forks by:
1. Removing the repository check in the `if` condition.
2. Adding `permissions: contents: read` to ensure the workflow
runs with minimal privileges, mitigating security risks.
3. Updating the `checkout` step to explicitly use the PR's head
repository and ref.
4. Fetching the `upstream` remote to ensure the git history is
complete for `tj-actions/changed-files`.
Additionally, a `.github/CODEOWNERS` file is added to require
review from @rgerhards for any changes to `.github/workflows/`,
further securing the CI configuration against malicious PRs.
Co-authored-by: rgerhards <1482123+rgerhards@users.noreply.github.com>
Why: reduce CI runtime and improve green IT/cost efficiency by stopping redundant work on failures.
Impact: compile matrix cancels on first failure; checks wait on compile.
Before/After: checks ran in parallel; now they run after a successful compile.
Technical Overview:
- Enable fail-fast in compile matrix to cancel remaining jobs.
- Trigger run_checks via workflow_run on compile completion.
- Guard run_checks to PRs with successful compile outcomes.
- Restrict run_checks to same-repo PRs to avoid elevated token risk.
- Recompute change filters in run_checks with changed-files.
- Skip container CI when no relevant changes are detected.
- No local tests run (workflow changes only).
With the help of AI-Agents: Codex
Thanks to AI, the commit style is very often not correct in interim
states. As such this check has become a very noisy signal and is no
longer worth it.
Instead, maintainers need to be a bit more careful during merge. But,
honestly, this almost-red check required that as well.
This refactor cleans up the root Makefile.am and aligns documentation
packaging with standard Automake structure. It improves maintainability
and keeps doc build logic localized, which helps container/CI setups.
BEFORE: Root Makefile.am listed all doc files via EXTRA_DIST.
AFTER: doc/Makefile.am owns the doc EXTRA_DIST and Sphinx targets.
Technical details:
- Added "doc" to SUBDIRS so Automake processes the directory.
- Added "doc/Makefile" to AC_CONFIG_FILES in configure.ac.
- Removed the hand-written doc/Makefile in favor of Automake-managed
doc/Makefile.am. The new file provides convenience targets
(html-local, html-with-sitemap, singlehtml, json, alljson, rag-db)
that wrap sphinx-build, and a clean-local rule.
- Updated doc/.gitignore to ignore generated Makefile/Makefile.in.
- The list of documentation assets was moved to doc/Makefile.am
(paths made relative to doc/). No runtime or ABI changes expected;
dist tarball contents intended to be unchanged.
Impact: Build/packaging only. CI or scripts calling old doc targets may
need to switch to "make -C doc html-local".
With the help of AI Agents: Google Jules, cubic dev ai, ChatGPT codex
- core: suppress pointer mismatch for UBSAN
The supression is just an interim solution until the pointer issue
has been fully analyzed and aligned (or considered OK w/ reasoning).
- suppress an issue in libcivetweb
This commit adds a context-aware RAG dataset generator and integrates
it into the build system to support advanced AI-driven documentation
workflows. It ensures a consistent knowledge base for RAG pipelines.
Impact: Adds doc/build_rag_db.py; output in build/rag/ (cleaned).
Before:
- No automated way to generate RAG-ready JSON from Sphinx doctrees.
- Nested code blocks in lists and notes were skipped during extraction.
- Fragile string parsing and broad exception handling in extractor.
- Data loss occurred due to hard truncation at 2000 characters.
- CI only ran HTML build, not RAG generation.
After:
- Recursive walker captures all nested code and prose thematic blocks.
- Thematic merging creates context-rich chunks (~2000 chars).
- Non-lossy chunking logic flushes buffer at natural boundaries.
- Metadata (module, scope, item) and syntax templates injected.
- Robust regex-based parameter parsing and specific error handling.
- Module-level constants for node types improve readability.
- Makefile target 'json-formatter' (and 'rag-db') automated the build.
- Project docs (README.md, AGENTS.md) updated with instructions.
- GitHub Actions workflow builds and uploads RAG artifact.
AI-Agent: Antigravity
With _target, we always get outdated doc into CI, which does not
really work for testing. So we switch back to just pull_request.
In this case, we cannot deploy the doc, but that's kind of OK.
We can probably later clean up the workflow once we know this change
here actually fixes the situation.
Security & CI improvements:
- Remove pull_request_target trigger (security vulnerability)
- Simplify checkout to use default behavior (matches other workflows)
- Reduce fetch-depth from 8 to 2 for change detection
- Simplify conditional logic throughout workflow
- Enable fork PR support: allow fork PRs to build docs and produce artifacts
- Make Pages deployment conditional: only deploy for same-repo PRs
- Update PR comments to handle fork vs same-repo PRs appropriately
Documentation fixes:
- Fix 3 instances of "it's" → "its" in reliable_logging.rst
- Fix 22 RST build errors: replace :json: roles with inline code in
6 mmdarwin parameter files
The workflow now follows the same pattern as 19 other workflows in the
repository, improves security posture, enables fork contributors to build
documentation, and fixes all documentation build errors.
OpenTelemetry adoption: provide a first-party path to ship rsyslog
logs directly to OTLP collectors, enabling cleaner OTel pipelines and
container-friendly deployments without sidecars.
Impact: new output module; user-visible config surface; off by default
unless explicitly enabled at build and in config.
Before: no native OpenTelemetry (OTLP) exporter in rsyslog.
After: new "omotlp" action streams logs via OTLP/HTTP JSON with
configurable batching (count/bytes/timeout), optional gzip, retry/
backoff, TLS/mTLS, custom headers, and proxy support.
Technically, the action holds immutable config while each worker owns
an HTTP client and a batch buffer guarded by a mutex. A small flush
thread handles timeout-based flushes; batches also flush immediately on
thresholds and when the action queue transaction completes. HTTP 2xx
acknowledges and clears the batch; 4xx drops it; 5xx maps to
RS_RET_SUSPENDED for retry by the action queue. Stats per instance track
batches submitted/success/dropped/retried, HTTP 4xx/5xx, records.sent,
and cumulative request latency. Parameters honor OTEL_* env var
fallbacks when not explicitly set. Build is gated behind
--enable-omotlp; docs and tests cover batching, compression, TLS/mTLS,
proxy, and trace-correlation flows.
Rename the Snare Windows Security parser module from "mmsnarewinsec"
to "mmsnareparse" for clearer naming and consistency with other parser
modules. Update code identifiers, build system, docs, tests, CI flags,
and paths accordingly.
What changed
- MODULE_CNFNAME set to "mmsnareparse"; default macro renamed
- Log/error/debug tags updated to "mmsnareparse"
- plugins/mmsnarewinsec/* moved to plugins/mmsnareparse/*
- configure.ac:
- add --enable-mmsnareparse
- AM_CONDITIONAL(ENABLE_MMSNAREPARSE)
- AC_CONFIG_FILES now includes plugins/mmsnareparse/Makefile
- Makefile.am subdir switch to plugins/mmsnareparse
- Tests renamed and updated (scripts and testsuites directory)
- Docs page renamed and examples updated
- CI workflow uses --enable-mmsnareparse
- Rebase to main; resolved configure.ac conflict
Impact
- Backwards-incompatible module name and configure flag changes.
Migration
- Config: module(load="mmsnareparse"), action(type="mmsnareparse")
- Build: use --enable-mmsnareparse
Co-authored-by: alorbach <alorbach@adiscon.com>
Real-world tarballs must be self-contained for doc builds. This change
verifies release completeness by building the docs from the tarball,
not the checkout.
Impact: Release tarballs now include additional doc assets; CI fails
early if a doc-required file is missing.
Before: CI built Sphinx docs directly from the repo tree. Missing files
could be masked by in-tree paths. After: CI creates a 'make dist'
tarball, unpacks it, and builds docs from that tree to catch omissions.
Technically, the doc workflow installs build deps, runs autoreconf and
a minimal './configure', issues 'make dist', unpacks into
'doc-builder/', and runs 'make html' under 'doc-builder/doc'. The
artifact path is updated accordingly.
For distribution, 'configure.ac' now composes DOC_FILES from
'doc/source' (*.rst, *.conf, *.jpg, *.png) and explicitly adds
'tutorials/cert-script.tar.gz', 'doc/Makefile', and
'doc/ai/module_map.yaml'. The duplicate listing of
'doc/ai/module_map.yaml' is removed from 'Makefile.am' EXTRA_DIST to
avoid drift; DOC_FILES remains the single source of truth for doc
payloads.
* ci/tests: add Elasticsearch 8 workflow
- allow the testbench to honour RSYSLOG_TESTBENCH_EXTERNAL_ES_URL
so externally managed Elasticsearch services can be reused without local
start/stop logic
- provision Elasticsearch 8 via GitHub Actions and run the omelasticsearch
suite inside the development container
With the help of AI-Agent: ChatGPT
Implement complete NXLog Snare-formatted Windows Security event parser
with multi-format support (RFC5424/RFC3164), 100+ field patterns, and
advanced features including GUID/IP/timestamp type detection, runtime
configuration, enhanced validation modes, and comprehensive test suite.
Features:
- Parse major Windows security event types (4624, 4625, 4634, etc.)
- Extract structured data into configurable JSON containers (!win default)
- Handle modern Windows telemetry (LAPS, TLS, WDAC, WUFB, Kerberos)
- Type-aware parsing with validation and fallback handling
- Runtime configuration support for custom field patterns
- Thread-safe design with no shared mutable state
- 9 comprehensive test scripts covering all functionality
Impact: Enables structured analysis of Windows Security events for
SIEM integration, threat detection, and compliance reporting while
preserving original payloads for forensic investigation.
Files: contrib/mmsnarewinsec/, tests/mmsnarewinsec-*.sh,
doc/source/configuration/modules/mmsnarewinsec.rst
Add comprehensive macOS CI support with two new GitHub Actions
workflows:
- run_macos.yml: PR-triggered CI with matrix strategy covering macOS
13–15, x64/arm64 architectures, and sanitizer combinations (none,
ASAN, TSAN)
- run_macos_weekly.yml: Scheduled weekly testing with full matrix
coverage and automated failure reporting via GitHub issues
- Set sin_len in tests/diagtalker.c on macOS to fix connect() EINVAL,
unblocking TLS certvalid tests.
Root cause and fix details (macOS testbench)
- Why tests failed
On macOS 14 the imdiag control listener often ended up IPv6-only.
The plain TCP listener creates an IPv6 socket and sets IPV6_V6ONLY;
the companion IPv4 bind can fail on macOS when sharing an ephemeral
port, leaving only the IPv6 listener active. Our injector
tests/diagtalker.c was IPv4-only (AF_INET to 127.0.0.1), so it could
not reach the imdiag port, causing repeated connect retries and
timeouts. CI logs showed “cannot connect to 127.0.0.1:<port> …
Connection refused” alongside benign OpenSSL anon-mode warnings.
- What we changed
1) Made the injector dual-stack by switching diagtalker to
getaddrinfo(AF_UNSPEC) and trying both IPv6 and IPv4 (with fallback
to 127.0.0.1 and ::1). This removes the hard dependency on IPv4
reachability when the listener is IPv6-only on macOS.
2) Added an opt-in testbench knob to enforce IPv4 where appropriate:
generate_conf() now honors RSTB_FORCE_IPV4=1 (or
RSTB_NET_IPPROTO=ipv4-only) to inject
global(net.ipprotocol="ipv4-only"). We enable this only in the IPv4
test variant so the IPv6 wrapper remains pure IPv6.
- Impact
The injector/listener address-family mismatch is eliminated, resolving
the macOS connect() failures and unblocking the TLS “certvalid” and
anonymous tests on macOS runners.
Refs: https://github.com/rsyslog/rsyslog/issues/5635
Refs: https://github.com/Homebrew/homebrew-core/pull/221869
Refs: https://github.com/Homebrew/homebrew-core/pull/226378
Add an openEuler 24.03 LTS development container and wire it into CI to
validate builds on that platform.
Why: expand RPM-based coverage and catch distro-specific build issues
early.
Impact: CI-only. No runtime or API changes.
Before: no openEuler container or CI job; build breakage went unnoticed.
After: dedicated container and matrix entry compile and run unit tests
on openEuler.
Notes: module and test coverage may differ on openEuler; track gaps in
follow-up issues.
