Rainer Gerhards c89113d531
core: add fromhost-port message property
Some deployments need to disambiguate multiple senders sharing an IP,
for example autossh or similar tunnel setups. Exposing the source port
improves observability and lets pipelines key on a stable tuple.

Impact: new property/JSON field; tcps_sess IF v4; out-of-tree modules
must rebuild.

Before: messages exposed fromhost and fromhost-ip only.
After:  messages also expose fromhost-port and jsonmesg includes it.

Introduce PROP_FROMHOST_PORT and wire it through msg.{h,c}. For TCP,
capture the remote port on accept, store it in tcps_sess, and attach it
to the msg on submit. For other inputs, resolveDNS derives the port from
the sockaddr when available; local inputs return an empty string. Add a
getter, duplication and destructor handling, and name<->ID mapping. Add
the field to jsonmesg output. Update docs, lexer keywords, and the
external plugin interface doc (property is modifiable). Bump
tcps_sessCURR_IF_VERSION to 4 and add SetHostPort() to the interface.
Include a focused test (fromhost-port.sh) that verifies the property.

Non-technical rationale: allow identification by (fromhost-ip,
fromhost-port) where IP alone is shared across systems (e.g., autossh).

With help from AI-Agents: ChatGPT
2025-09-09 14:29:39 +02:00
2025-09-05 09:35:26 +02:00
2019-12-26 17:37:14 +01:00
2025-09-05 09:35:26 +02:00
2019-07-24 13:30:09 +02:00
2025-07-17 18:26:38 +02:00
2022-02-17 10:54:12 +01:00
2009-07-15 12:34:59 +02:00
2018-12-30 17:19:14 +01:00
2025-09-09 12:07:58 +02:00
2025-08-26 12:11:51 +02:00
2025-08-26 12:11:51 +02:00
2012-01-11 18:30:33 +01:00
2019-12-26 17:37:14 +01:00
2019-12-26 17:37:14 +01:00
2013-12-22 15:47:35 +01:00
2019-12-26 17:37:14 +01:00
2025-08-26 12:39:39 +02:00
2022-02-17 10:54:12 +01:00
2004-11-08 13:52:36 +00:00

Rsyslog - What is it?

Help Contribute to Open Source

Rsyslog is a rocket-fast system for log processing.

It offers high-performance, advanced security features, and a modular design. Originally a regular syslogd, rsyslog has evolved into a highly versatile logging solution capable of ingesting data from numerous sources, transforming it, and outputting it to a wide variety of destinations.

Rsyslog can deliver over one million messages per second to local destinations under minimal processing (based on v7, Dec 2013). Even with complex routing and remote forwarding, performance remains excellent.


getting rsyslog news


🤖 rsyslog Assistant (Experimental AI Help)

Need help with rsyslog configuration or troubleshooting? Try the rsyslog Assistant — your AI-powered support tool, built by the rsyslog team.

⚠️ Experimental. May occasionally generate incorrect config examples — always review before applying.

Trained on official docs and changelogs Covers both Linux rsyslog and Windows Agent Version-aware and best-practice focused

👉 Try it now: chatgpt.com/g/g-686f63c947688191abcbdd8d5d494626-rsyslog-assistant

Getting Help (Other Sources)


Installation

Via Distribution Package Managers

Rsyslog is available in the package repositories of most Linux distributions. On non-systemd systems (e.g., Ubuntu), rsyslog is often pre-installed.

Project-Provided Packages (for latest versions)

Distributions often lag behind in packaging the latest rsyslog releases. Official builds for newer versions are available here:

Building from Source

See: Build Instructions

Build Environment Requirements

  • pkg-config
  • libestr
  • liblogging (stdlog component, for testbench)

Build support libraries from source if you're working with the latest git master.

OS-specific Build Instructions

Refer to the respective section in the original README for required packages on CentOS, Ubuntu, Debian, SUSE, etc.

Development Containers & Testing

Ready-to-use build environments are provided in packaging/docker/dev_env. These images were previously built in the separate rsyslog-docker repository and are now maintained here. See packaging/docker/README.md for details. Runtime container definitions are in packaging/docker/rsyslog. Run the test suite inside the container with make check (limit to -j4).


Contributing

Rsyslog is a community-driven open-source project. Contributions are welcome and encouraged!

Commit Assistant (recommended): Draft compliant commit messages with https://www.rsyslog.com/tool_rsyslog-commit-assistant (see rules in CONTRIBUTING.md). Put the substance into the commit message (amend before PR if needed).


AI-Based Code Review (Experimental)

We are currently testing AI-based code review for pull requests. At this time, we use Google Gemini to automatically analyze code and provide comments on new PRs.

  • These reviews are informational only.
  • Every contribution is still manually reviewed by human experts.
  • The goal is to evaluate how AI can support contributor feedback and code quality assurance.

Please report any issues, false positives, or suggestions about the AI review process.


Documentation

Documentation is located in the doc/ directory of this repository. Contributions to the documentation should be made there.

Visit the latest version online:


Project Philosophy

Rsyslog development is driven by real-world use cases, open standards, and an active community. While sponsored primarily by Adiscon, technical decisions are made independently via mailing list consensus.

All contributors are welcome—there is no formal membership beyond participation.


Project Funding

Adiscon GmbH supports rsyslog through:

  • Custom development services
  • Professional support contracts

Third-party contributions, services, and integrations are welcome.


Contributions to rsyslog are stored in git history and publicly distributed.

Description
a Rocket-fast SYStem for LOG processing
Readme 293 MiB
Languages
C 68.6%
Shell 20.9%
JavaScript 2.5%
Dockerfile 2.4%
Makefile 2.2%
Other 3.2%