1#@!#!123s

file_get_contents 1#@!#!123s
: / usr / share / doc / nxlog-ce /
Filename : ChangeLog.txt
back
* 2023-04-13 3.2.2329
   [4691] file_name() fixed 
* 2022-10-03 3.1.2319
   [4631] Fixed timezones and warnings in src/common/date.c
   [4613] Fixed memory leak in om_python
   [4555] Updated openssl to 1.1.1q in windows and docker image to RockyLinux9 to address CVE-2020-1971 and CVE-2020-1968
   [3844] Fixed parsing error in om_raijin
   [3712] Fixed syslog severity in xm_syslog
   [4539] Added support for Redhat 9
   [4251] Added support for Ubuntu 22
   [3854] Fixed inconsistencies in the default nxlog-ce config
   [4450] Fixed a crash caused by a double free in om_ssl socket
* 2022-05-13 3.0.2284
   [3469] fixed Python integration on Windows
   [3926] fixed excess CPU usage when im_msvistalog is loaded
   [4065] fixed exit crash on Windows
* 2021-12-13 3.0.2272
   [2985] fixed an error in om_file leading to a potential DoS reported in CVE-2020-35488
   [3503] fixed an error in exec_async causing a file handle leak on Windows
   [2655] updated Linux packages to use systemd units
   [2653] fixed build issues on recent opensuse versions
   [2267] removed obsoleted pm_filter module
   [2278] added im_pipe module
   [3343] added support for quoted literal file names in the configuration
   [2769] updated xm_kvp to match NXLog Enterprise version 5's implementation
   [2270] added xm_grok module
   [2277] added im_systemd module
   [2271] updated im_tcp and om_tcp
   [2272] updated im_udp and om_udp
   [2269] added Perl language integration modules
   [2639] removed 256 source limitation from im_msvistalog
   [2268] added python language integration modules
   [2639] added Raijin output module - om_raijin
* 2021-01-06 2.11.2190
  An error causing systemctl stop to leave nxlog running has been fixed
  Build  error on initial build without documentation has been fixed
  om_file data loss on log rotation has been fixed
  om_udp hang on reconnect has been fixed
  Memory leak caused by oversize strings has been fixed
  Docker build has been added
  Debian 10 Buster build has been added
  CentOS/Redhat 8 build has been added
  Ubuntu 20.04 build has been added
  Debian Wheezy build has been dropped
  CentOS/Redhat 6 build has been dropped
  Ubuntu 14.04 build has been dropped
* 2018-05-03 2.10.2102
  Implemented Listen mode for om_tcp which enables clients to connect to it.
* 2016-07-05 2.9.1716
  Added a workaround for the 256 source limit in the autogenerated QueryXML in im_msvistalog.
  Added a workaround for a possible windows bug when im_msvistalog was giving "EvtNext failed with error 1734: The array bounds are invalid."
  Prevent loss of unprocessed data in im_file buffers upon restart.
  A leap-year bug was present when parsing dates without a year i.e. Feb 29 showed up as 2016-03-01.
  Fixed an issue in im_msvistalog that could cause a random crash with custom application logs.
  Fixed apr_pollset_poll and "unexpected data from server" errors in om_http when the remote server sent fragmented data.
  im_file now properly updates the file position after each read, not only on EOF.
  Fixed a reconnection/response timeout issue in om_http.
  om_http will now attempt to reconnect on all errors.
  Added a PollInterval directive to im_dbi.
* 2015-12-08 2.9.1504
  Added a workaround for an APR bug where the memory pool allocated by the APR pollset
   could grow too large under heavy load under linux/epoll.
  om_http will now attempt to reconnect on all errors.
  Add locking to the dbi modules as a workaround for the mysql_init race condition issue.
  The dbi modules can now use the new reeantrant API if libdbi provides it.
  Fixed a memory leak caused by convert_fields("AUTO").
  The JSON parser can automatically detect datetime values - no need to call parsedate().
  Field limit in CSV parser was raised to 200.
  xm_gelf handles ShortMessage as is without doing any truncation if it exists.
  Fixed a leak in xm_fileop's file_remove() and another in the regexp replacement operator when using /g.
  parsedate() can now also handle integer timestamps with an optional fractional part.
  Enhanced the replace() function to handle undefined values better.
  Add locking to the dbi modules as a workaround for the mysql_init race condition issue.
  The dbi modules can now use the new reeantrant API if libdbi provides it.
  Fixed a memory leak caused by convert_fields("AUTO").
  There was a memory leak in xm_kvp module's to_kvp().
  The linebased reader did not trim trailing CR when CRLF was on the buffer boundary.
  The to_syslog_snare() formatter creates the date string with double digits instead of padding with space.
  Flow-control is explicitly disabled with reroute() and add_to_route().
  Fixed an issue in im_file getting into a loop with CloseWhenIdle enabled.
  IETF Syslog parser properly skips UTF BOM header.
  The set_request_path() procedure in om_http was leaking memory.
  Deleted files could cause an excessive logging of "input file was deleted" in im_file.
  A <QueryXML> block has been added to im_msvistalog that can be used to specify the XML query without using '\' to join multiple lines.
  <Exec> can be used as a block to avoid line continuation breaks '\'.
  The IN operator has been implemented.
  Fixed an issue related to the csv parser creating undefined values that could lead to a crash in some cases.
  The string() function was leaking memory.
  Some large eventlog entries caused a crash or hang with im_msvistalog.
  Updated openssl libraries on windows to 1.0.2a to support TLSv1.2.
  The om_tcp and om_ssl modules now provide a reconnect() procedure.
* 2015-03-10 2.9.1347
  Fixed a regression in im_file which was causing excessive memory usage with a large number of files.
  Do not swallow empty lines in LineBased reader.
  Fixed issues with oversized strings reaching the internal string limit.
  All SSL networking modules allow TLS by default.
  Fixed an issue with oversized binary messages generating "ASSERTION FAILED: "logqueue->needpop == TRUE".
  All tcp based network modules are now using TCP_KEEPALIVE to detect dead peers.
  Null-dereference and error handling fixes for im_file to handle error conditions better (e.g. errors from network shares).
  The xm_gelf extension now supports GELF_TCP and a ShortMessageLength directive has been added.
  The parser did not handle "\/" properly inside regular expressions.
  Fixed the assertion failure "logqueue.c/nx_logqueue_push(): "logdata->link.prev == NULL" in pm_buffer.
  Reloading on windows caused pm_buffer to emit "ERROR couldn't open disk buffer file - Access is denied".
  The Syslog_TLS input reader has been fixed to correctly parse data instead of reporting "invalid header received by Syslog_TLS input reader".
  Fixed an off-by-one error in the CSV parser which resulted in a crash on invalid input in some cases.
  Added missing error checking to the config parser when Schedule block did not contain When or Every.
  There was a possible infinite loop when sending zero length data (i.e. empty udp packet).
  Fixed a crash in im_msvistalog when "Failed to retrieve eventlog user data" was encountered.
  The year was uninitialized when parsing an rfc3164 date with microsecond precision in nx_date_parse_cisco.
  Hexadecimal ASCII character codes in the character specification are now accepted by xm_csv.
  The csv parser does not swallow the escape character in an invalid escape sequence.
  Fixed a crash when the File directive for om_file contained an invalid string expression.
  The om_http module could leak the SSL context when the remote socket was forcibly closed.
* 2014-07-19 2.8.1248
  The rename_field() procedure was removing the field if the source and destination were the same.
  The regexp and regexp replacement operators can now be used as statements, i.e. Exec $Message =~ s/aaa/bbb/;
  Regular expressions now support the /m modifier to do multiline matching.
  Regular expressions now support the /i modifier to do caseless matching.
  Regular expressions now support the /s modifier to make the '.' match newline characters.
  Fixed a regression introduced with the ActiveFiles directive in im_file when more than one truncation
   did not get noticed. (ticket #40@sf) Credits go to 'savionat'.
  Implemented missing parser support for IPv4 literals.
  Added a host_ip() function to return the IP address associated with the hostname.
  Using exec_async() could have exhausted the memory if it was called at a very high rate.
  om_udp would stop sending messages in some cases after logging "apr_socket_send failed;Connection refused",
   e.g. when graylog2 was not accepting udp packets. It should properly resume now.
  The to_syslog_snare() formatter should now produce better snare compliant output.
  Replace space, ']' and '"' with underscore in IETF syslog structured data field names.
  Context cleaning would result in a segfault in pm_evcorr's thresholded rule if there was no triggering.
  im_tcp and im_ssl on windows is not limited to 500 connections anymore.
  Non-wildcarded File contents would get lost with ReadFromLast FALSE when the file did not exist
   but did appear with unread data.
  im_file does not emit "input file does not exist" warnings at every PollInterval.
  The file_name() function caused assertion failures in some cases on shutdown.
  A regression caused a crash with im_file when the File did not exist.
  A typo in the code was causing a memory leak with rename_field().
* 2014-02-03 2.7.1189
  The LICENSE has changed.
  Added a new extension module to parse binary wtmp files on Linux.
  Fixed a regression causing a crash after the 'failed to determine FQDN hostname' error message.
  The to_syslog_*() procedures can now use $raw_event if $Message is unset to make it easier to convert to syslog.
  Added a fix to im_msvistalog to handle the "EvtNext failed with error 13: The data is invalid." error better.
  The im_file module now emits the last event when using with the xm_multiline extension.
  Fixed the issue with more than 20 fiels and xm_multiline reported in ticket #33.
  Json parse errors in raw_event could cause a double free resulting in a crash or undefined behavior.
  It is now possible to use multiple instances of xm_perl.
  Disallow using a single processor module instance in multiple routes.
  The file_chown() procedure in xm_fileop works with user/group names in addtion to uid/gid values.
  CloseWhenIdle directive for im_file.
  File removal in some circumstances caused im_file to emit "input file does not exist" messages on windows.
  In same rare cases im_file would give a panic on windows with "im_file got EAGAIN for read".
  The regexp replacement operator s/// was leaking memory.
  In some circumstances excess CPU was used when im_file watched several files.
  Added some more performance optimizations to im_file to handle a large number of wildcarded files
   so that it should consume less resources than before. It also comes with a new DirCheckInterval and
   an ActiveFiles directive which can help in some cases when monitoring wildcarded files.
  Added a RenameCheck directive to im_file which should help detecting renamed/rotated files.
  The deb installer got stuck after trying to (re)start the daemon.
* 2013-10-14 2.6.1131
  Service control manager could not properly shut down the service on windows2003 and possibly other windows 
   versions. This could have resulted in unsaved positions and duplicated log collection on system restart.
  Fixed a panic in nx_config_cache_write() during shutdown.
  Fixed an assertion failure when pm_pattern was trying to set an invalid datetime field.
  The installer adds 'eventlog' as a dependency for the nxlog service.
  Some error conditions (e.g. The interface is unknown, Access is denied, Invalid parameter, etc) should be
   handled better now by im_mseventlog. 
  The reroute() and add_to_route() procedures were leaking memory.
  Some xm_fileop procedures did not work properly on windows, e.g. file_remove() with wildcards.
  im_exec was consuming excess CPU on windows in some cases.
  Fixed a memory leak in pm_buffer.
  Added xm_kvp to the windows wix build script so that it is now included in the msi package.
  Added an UndefValue directive to the xm_csv module to make parsing W3C logs containing the dash "-" more painless.
  The parsedate() function now returns an undefined datetime type instead of aborting execution with an error.
  The drop() procedure now aborts further evaluation of statements so that an else branch is no longer
   required when dropping events conditionally.
  Suppress repeating "failed to open directory" error messages in im_file.
  Fixed bad filenames in logged config locations caused by the include directive.
  Experimental MacOSX port.
* 2013-07-04 2.5.1089
  An SSL cert verification failure caused successive verifications to fail in im_ssl and related modules.
  Potentially fixed im_file giving "Partial results are valid but processing is incomplete" errors.
  Fixed status value tests which resulted in an endless loop on windows with pm_buffer's disk mode
   and possibly some functions in xm_fileop.
  im_msvistalog now retrieves the message from events with invalid substitution strings (%xx) 
   instead of inserting the message "The description for EventID EVTID from source SRC cannot be found".
  create_stat(name, COUNT) did not work properly.
  The xm_multiline module now supports an EndLine directive.
  Add / to the list of valid syslog hostname characters to support chained hostnames.
  Starting with a thread count higher than 15 resulted in a segmentation fault on windows.
  A new extension module xm_kvp has been added to parse and generate key-value pairs.
  The file_basename() function provided by xm_fileop did not work porperly on windows.
  Added packaging files for solaris, suse, rhel5.
  An empty pidfile was causing an assertion failure on startup on unix/linux.
  Serialization of Binary types was not handled properly and resulted in a PANIC in value-serialize.c.
  Fixed a segfault when nxlog gave a 'failed to determine FQDN hostname' error message on start.
  Properly parse RFC5424 timestamp format in UTC with a trailing 'Z'.
* 2013-04-30 2.4.1055
  Fixed packaging for Centos/Redhat 6.
  Regexp and regexp replace operators now support the '\' escape character to be able to specify '/' as '\/'.
  Corrected a use-after-free when trying to set $raw_event to an undefined value or non-string type.
  Fixed a race condition in im_ssl which could result in a segmentation fault under rare circumstances.
  Connection error handling should be more robust now in om_tcp and om_ssl.
  The Reconnect directive has been obsoleted, this is handled automatically now.
  Fixed some build issues with Solaris.
  The xm_perl module can be explicitly disabled even if perl is found.
  Tweaked the build process so that it compiles and works on IBM AIX.
  Fixed default sample configs (#17).
  Added a hostname_fqdn() function to return the hostname with the domain part.
  The include directive now supports wildcards in file names to be able to include multiple files in a directory.
  im_exec has been fixed on Windows and now comes with a Restart directive.
  Added a FlowControl directive (global, input and processor module level).
* 2013-03-11 2.3.1027
  The pm_evcorr module has been added with advanced event correlation capabilities.
  A memory leak has been fixed in the expression evaluator when comparing an undef value against a string.
  pm_pattern's REGEXP match now works with integer fields.
  IETFTimestampInGMT config directive added to xm_syslog. Timestamps are now emitted in local time in IETF syslog.
  Fixed microsecond formatting in IETF syslog (credits go to Eric Wetzel).
* 2013-02-07 2.2.1017
  Regexp substitution is now supported with s/// and s///g.
  Enhanced error reporting in pm_pattern when 'pcre match_limit reached' is logged.
  The json parser leaked memory when input contained raw_event.
  Fixed possible race conditions with memory pool handling.
  Shutdown sequence reverted to non-async mode.
  Load module in STOPPED state in case of config errors.
  The delete() procedure was leaking memory.
  Module fields.xml files are now installed.
  Compile with -Werror=format-security and -Wformat if gcc accepts it.
  Fix invalid write in im_udp with apr-1.2 (mostly affecting Centos/Redhat 5).
  nxlog-stmnt-verifier loads all locally available modules.
  Fixed a possible endless loop in im_exec.
  The rename_field() procedure now removes the 'new' field if it exists before renaming 'old' to it.
  Updated the reference manual with some examples about parsing syslog from Cisco devices.
  Added Cisco ASA/PIX timestamp format which can be parsed automatically: Nov 3 2005 14:50:30
  Fixed expression handling for dynamic filenames in im_file so that it is not only evaluated at startup.
  SockBufSize option for im_udp and om_udp.
  PollInterval directive for im_msvistalog.
  Channels are queried directly from the system instead of the registry in im_msvistalog.
* 2012-12-18 v2.1.956
  Added a new output module om_http to send logs over HTTP/HTTPs.
  Two new procedures: reroute() and add_to_route().
  It is now possible to programatically stop and resume the data flow with pm_blocker using the new block() procedure.
  The pm_buffer module now uses file chunks to store the data. Assertion failures were fixed (regression in the 2.0 series).
  Fixed an infinite loop when "binary logdata (x bytes) does not fit in output buffer".
  Fixed im_mseventlog subscription error on windows 2008, a warning is logged now.
  replace() gave an assertion failure if the source did not contain anything to be replaced.
  Fixed a double free in drop().
* 2012-10-31 v2.0.926
  Fixed a memory leak in xm_csv's parse_csv().
  Added SnareDelimiter and SnareReplacement directives to xm_syslog to be able to customize Snare syslog output.
  The xm_csv module can now format CSV without quoting strings using the new QuoteMethod directive.
  A new extension module xm_perl has been added to enable log processing directly from perl.
  Added more sanity checks to Application log sources in im_msvistalog to avoid "invalid query xml" errors.
  Added a function dropped() to test whether a message has been dropped.
  The 'Processors' directive within a module instance config block has been obsoleted.
  Blacklist non-wildcarded single files which don't exist in im_file.
  Fixed memory leak in im_file with deleted files, suppress "Module xxx has no input files to read" messages.
  Locking for statistical variables and counters.
  Handle status parameter in init scripts.
* 2012-08-27 v1.4.803
  Fixed a race in windows service shutdown, configcache.dat was not saved.
  Fixed an uninitialized variable use in the replace() function.
  Added proper synchronization to configcache calls.
  Added a PollInterval to im_file.
  Error conditions are now handled better in im_file with auto blacklisting and retry.
  Further optimized im_file to handle a large number of files.
  There was a regression in om_dbi introduced in @734 which broke the SQL statement parser (fix by Chris Lemmons).
  Fixed a memory leak in om_dbi.
  im_msvistalog pulls all non-system application logs by default (ticket #8).
* 2012-07-17 v1.4.764
  Added buffer_size() and buffer_count() to pm_buffer and a section 'Explicit drop' to the docs.
  Processor modules could potentially get stuck in paused state.
  Fixed possible reconnect bug when openssl returns EBADF (storage control block address invalid).
  Added size(), replace() substr() functions to the core.
  Fixed asertion failure in om_dbi when a value is undef.
  Use syslog severity "WARNING" instead of "WARN".
  Allow trailing undef in CSV lines in xm_csv.
  Bundle fields.xml in the source to describe the fields used by the modules.
  im_file has been rewritten to support a large number of files.
* 2012-06-03 v1.4.729
  A new extension module xm_multiline has been added for multi-line message parsing.
  Timeout increased to 15 seconds when SIGTERM is sent.
  Fixed file_cycle() on windows (gave ERROR failed to check whether file exists).
  xm_fileop was missing from the WIX build file (and thus the MSI package).
  Added datetime(INTEGER) and ip4addr(INTEGER) functions.
  im_exec kills the process if it did not exit on module shutdown.
* 2012-05-18 v1.4.712
  String literals specified with double quotes can contain escape sequences such as \n.
  im_exec used a non-blocking pipe which resulted in buggy reads.
  pm_norepeat was leaking memory.
  Error messages from runtime statement evaluation now contain the error location.
  Module start stop is now async which should fix segfaults caused by race conditions
   during shutdown.
  Documentation has been updated with information about the new xm_fileop, the Troubleshooting
   and Log rotation sections.
  A new extension module xm_fileop has been added to support various file operations
   to implement log rotation and retention.
  Windows build now comes with apr-1.4.6. Should solve "failed to create pollset
   A non-blocking socket operation could not be completed immediately." errors on service start.
  Async module start/stop to fix random segfaults on shutdown.
* 2012-04-19 v1.4.686
  Print error location (file, line, charpos) of invalid code defined in Exec.
  om_tcp could segfault on remote connection reset.
  Fixed excess memory use by pause/resume event deduplication.
  om_tcp could truncate large buffer writes under hevavy load and slow network.
  All field types work in pm_pattern's matchfield.
  Added a hostname() function to the core.
  There was an off-by-one in regexp captured substring references.
  Added an <exec> block into pm_pattern pattern database xml file.
  integer(unknown) works also.
  Added a CreateDir option to om_file.
  Allow x() instead of self->x() when calling private module functions or procedures from self.
  Added a file_name() function to im_file.
  $SourceModuleName and $SourceModuleType are always set in input modules.
  Documented core fields under the Modules section.
  Fixed "failed to restore the saved position from bookmark xml" error in im_mseventlog.
  om_udp and om_uds could hang when sending data.
  xm_csv now supports non-printing and whitespace characters for delimiter, escape and quote chars.
  Raised regexp captured substring limit to 100 from 20.
  Undef value now properly handled with Binary In/OutputType.
  Only link libssl to modules using it.
  Support strptime() on platforms without it (e.g. Windows).
  parsedate() now supports another loser format: 2011-5-29 0:3:21.
* 2012-03-25 v1.4.635
  xm_xml: a new extension module for parsing and generating XML.
  xm_json: a new extension module for parsing and generating JSON.
  xm_gelf: a new extension module for generating GELF.
  Add JSON and XML to Input/OutputFormats for pm_transformer.
  Enhanced the documentation with datetime parsing.
* 2012-03-02 v1.4.607
  Can now be compiled with older APR v1.2.
  Fixed regression in im_file caused by ReadFromLast with wildcarded files.
  Memory allocation is more conservative, nxlog should be generally using less memory.
  Added reload/restart to init scripts.
  Documentation was enhanced, added new chapters: sources.xml, processing.xml, forwarding.xml.
  Removed unsafe calls from signal handlers.
  Fixed various potential memory leaks and race conditions.
  Additional group memberships are honoured on unix/linux when the User directive is defined.
* 2012-01-24 v1.4.571
  The code can now be compiled for Android.
  The im_mseventlog and im_msvistalog now set the AccountType and Category fields.
  SNARE Syslog format support for output.
  ReadFromLast configuration directive for im_mseventlog and im_file.
  The im_mseventlog module can now produce output in UTF-8.
  The im_mseventlog module's error handling was enhanced and is more fault tolerant
  against the EventLog subsystems failures.
  LICENSE and ChangeLog.txt was missing from the tar.gz source package.
  iconv/libiconv dependency was made optional.
  Documentation updates and fixes.
* 2012-01-01 v1.4.539
  pm_transformer's InputFormat defaults to none if not specified.
  om_dbi reconnect fix for MySQL.
  Rewritten I/O which yields 2-3x performance boost in some situations.
  IETF Syslog (RFC 5424, 5425, 5426) support in xm_syslog and pm_transformer.
* 2011-12-05 v1.2.494
  Fixed a database reconnection issue in om_dbi which was affecting postgresql.
  Syslog conversion now strips newlines from the message.
  A new module, im_msvistalog was added to support reading all messages from
  Windows EventLog on Windows2008, Vista and later.
* 2011-11-14 v1.2.464
  Added README.txt to windows package.
  Fixed service start from command line when invoking nxlog.exe directly.
* 2011-11-05 v1.2.461 
  exec_async() was creating zombie processes in some cases.