Use a documentation-only IP to avoid confusion and follow best practice.
This prevents irritation when users or scanners see a private address in
samples and wonder if rsyslog is trying to contact it.
Impact: Visible change in sample payloads, tests, and docs (host field).
Technical: Replace the hardcoded "172.20.245.8" in imdiag's generated
messages with a constant default hostname "192.0.2.8" from RFC 5737
(TEST-NET-1). Update tests (e.g., omrabbitmq, perctile, mmexternal,
clickhouse) and template examples to match. No API/ABI change; no effect
on action queues, OMODTX, retry/duplicate semantics, or HUP behavior.
This is purely about sample message contents emitted by the diag tool.
Before/After: samples used 172.20.245.8 -> now 192.0.2.8.
See also: https://gitee.com/src-openeuler/rsyslog/issues/I7V4I8
Fixes: https://github.com/rsyslog/rsyslog/issues/6190
Add an openEuler 24.03 LTS development container and wire it into CI to
validate builds on that platform.
Why: expand RPM-based coverage and catch distro-specific build issues
early.
Impact: CI-only. No runtime or API changes.
Before: no openEuler container or CI job; build breakage went unnoticed.
After: dedicated container and matrix entry compile and run unit tests
on openEuler.
Notes: module and test coverage may differ on openEuler; track gaps in
follow-up issues.
This is part to make the documentation more accessible and easier to read and find (for human, SEO and AI).
Also, the documentation content has been improved, e.g. by adding additional information which was previously (incorrectly) assume to be present by users.
This is a stepping stone which provides much value. But there is still lots of room for improvement.
- add per-parameter reference files for mmanon action settings
- replace inline parameter tables with summary list-table and toctree
- keep parameter summaries accessible from module page
With the help of AI-Agent: ChatGPT
Improve AI-facing documentation to speed up contributor onboarding after
the gpt5-codex agent update. The guides clarify bootstrap, testing, and
where to find module ownership so agents can work predictably and avoid
expensive CI-only paths.
Impact: documentation-only; no runtime changes. Clarifies when to use
direct test scripts vs. the autotools harness.
This introduces repository-wide AGENTS guides (root, plugins/, contrib/,
tools/, doc/) plus module-focused guides for omelasticsearch, imkafka,
omkafka, and omruleset. It adds metadata templates for core and contrib
modules, initial MODULE_METADATA.yaml files for the Kafka and ES modules,
and a tools/MODULE_METADATA.json for built-ins. The top-level guide now
includes quick links, “priming a fresh AI session,” and explicit
autotools bootstrap instructions (run ./autogen.sh when autotools inputs
change). Testing guidance asks agents to prefer invoking ./tests/*.sh
directly, reserving `make check` for CI reproductions. The doc subtree
gains its own AGENTS.md and an AI doc-builder base prompt to keep edits
consistent. doc/ai/module_map.yaml was annotated to reference per-module
metadata.
Before: scattered or missing agent guidance; unclear when to bootstrap
autotools or run the full harness. After: structured, discoverable docs,
templates, and metadata that align contributor workflow across modules.
Newer Elasticsearch versions reject typed APIs. This adapts the module
so shipping works out of the box with modern clusters and keeps the
codebase aligned with typeless ES conventions.
Impact: bulk metadata no longer includes _type unless explicitly set.
Old setups that relied on a default "events" type (ES < 8) may need
explicit configuration.
Technically, the default searchType is now NULL
(OMES_SEARCHTYPE_DEFAULT). setPostURL continues to route requests to
the typeless /_doc endpoint, but bulk metadata is generated without a
_type field when searchType is unset. The legacy default "events" for
ES < 8 is removed. Tests are updated to stop passing searchType, and
the searchType-empty test is dropped to reflect the new default. No
OMODTX or action-queue semantics change.
Closes: https://github.com/rsyslog/rsyslog/issues/5060
We want easy nested JSON to match common schemas (e.g., Elastic ECS)
without external processors. This introduces an opt-in mode so existing
jsonf users keep exact behavior while enabling structured output when
requested.
Impact: No change unless option.jsonftree is enabled. With jsonftree,
dotted outnames render as nested objects; empty containers are skipped.
On name collisions (object vs value), we fall back to flat rendering.
Before: jsonf always emitted flat name/value pairs, even for dotted
outnames. After: jsonf remains flat by default; enabling jsonftree makes
"host.hostname" and "host.ip" render as {"host":{"hostname":...,"ip":...}}.
Technically, we add option.jsonftree to templates. When set, we lazily
build a per-template JSON tree (tplJsonNode) from dotted segments and
render it in one pass, reusing existing jsonf formatting for leaves.
The tree state is tracked on the template and freed on template delete.
Config parsing enforces mutual exclusivity among sql, stdsql, json,
jsonf, and jsonftree. Constants record bJSONf to reuse serialized
fragments. Tests cover nested output and pure-json cases using
option.jsonftree.
Overview has been streamlined, also some samples adjusted. This
is a consistent state. Further updates to these pages will be expected
when new functionality, currently underway, is added.
The new doc better aligns with how templates and mapping is understood
in the current cloud native infrastructure.
More updates are upcoming.
Also add some generally useful cross-reference anchors.
If there is no user in the data base with user ID uid, getpwuid() returns a null
pointer value. Therefore, it is necessary to check the return value of the function
to prevent segfault caused by dereference of null pointer.
In addition:
[1] Free the memory allocated for the current session identifier sessions_list[j]
to prevent a memory leak.
[2] Use LogError instead of dbgprintf to display error reports to the user.
Make default handling more natural for modern logs, especially JSON
lines. This aligns with common expectations of line-separated records
and reduces surprises when viewing files with standard tools.
Impact: Default changes; messages without trailing LF now get one added.
Backward-compatibility: We accept this change because the common and
portable convention is LF-terminated records. Most users expect this,
and many tools assume it. The risk is limited to consumers that require
byte-identical output without a final LF. Those users can restore the
old behavior by setting addLF="off" globally or per action.
There was also some clean-up of variable names and the removal of
accidentally included obsolete-legacy style config directive.
Previously, omfile wrote rendered messages as-is unless addLF was set.
This could yield "incomplete lines" when templates did not terminate
with LF. We now default addLF to on and only append when the message
does not already end with LF, preserving existing full-line writes.
The change is implemented by making the instance default true; module-
and action-level settings continue to override. Behavior remains
transparent with compression and crypto providers; no ABI/API impact.
Before: messages lacking LF were written without a final newline.
After: such messages are written with a single LF appended.
* mmdblookup: split parameter docs
Split module and input parameters into per-parameter reference files and replace inline tables with summary list-tables in the module docs. Add a hidden toctree for the new parameter pages. Documented parameters now share reusable anchors and summaries.
With the help of AI-Agent: ChatGPT
* omfile: add addLF option to append newline
Add a boolean addLF option for omfile that appends a trailing LF when
the rendered message does not already end with one. The setting is
available as both a module and action parameter (default off) and it is
propagated to legacy configuration and signature providers.
Documentation and a regression test cover the new behaviour.
With the help of AI-Agent: ChatGPT
* doc: add mmaudit module documentation
- add Sphinx page that explains how mmaudit detects Linux Audit records and exposes parsed fields under the $!audit subtree
- cover the quoting limitation, parse-success flag, and an example using get_property() for awkward field names
- note the configure option required to build the optional plugin
With the help of AI-Agent: ChatGPT, Gemini
This parses the LEEF message (if it is) and creates a JSON subtree.
The current implementation is PoC and will be provided to gather
early review.
Changes, including breaking changes, may happen in future versions of
this module.
We invalidly specified the source distribution, which does not include
the necessary class files. This lead to zookeeper start failure and thus
no kafka tests being executed.
* tests: improve kafka startup readiness handling
* add generic TCP wait helper and kafka readiness check that replaces fixed sleeps in start_kafka
* verify zookeeper client port availability after startup
* replace ad-hoc sleeps in kafka-focused tests with wait_for_kafka_startup
* rely on kafka-topics probe instead of port checks
* share kafka layout helper to avoid duplicated logic
* align kafkapid emptiness checks for consistent style
With the help of AI-Agent: ChatGPT
Non-technical: test flakiness makes it hard to validate unrelated changes.
This aligns omelasticsearch tests with ES 7.14 defaults to get the
testbench back to a deterministic state and pave the way for further
modernization.
Impact: test behavior changes; one test skipped; CI coverage slightly reduced.
Before: tests mixed ES 6-era types and ad-hoc tarball picks; deprecation
checks intermittently failed and retries were brittle. After: tests use the
7.14.1 tarball via diag.sh default, typeless mappings, and `_doc` type in
omelasticsearch actions; known-flaky bulk-retry test is skipped for now.
Technical details:
- Add `searchType="_doc"` to all omelasticsearch actions and update index
provisioning to typeless mappings compatible with ES 7.14.
- Remove script-level `ES_DOWNLOAD` overrides to follow diag.sh's 7.14.1
default, keeping test scripts and helper defaults in sync.
- Drop deprecation-log assertion in `es-searchType-empty.sh` to prevent
spurious failures specific to ES 6-era types.
- Temporarily skip `es-bulk-retry.sh` (exit 77) pending a rewrite of retry
semantics under ES 7.x.
- CI: export `VERBOSE=1`; disable Kafka and Elasticsearch tests in the
affected matrix job to keep CI green while ES/Kafka suites are refactored.
VERBOSE ensures test logs are emitted to stderr and as such are
visible in CI test runs.
- Minor whitespace/indent cleanups; no runtime code or plugin behavior
changes.
