rsyslog

rsyslog 8.2606.0

June 2026 scheduled-stable release.

Scheduled-stable releases are bi-monthly snapshots of the daily-stable branch,
providing predictable update points with the same functional content as
daily-stable at the time of the snapshot.

Highlights

• Experimental TCP stream compression for omfwd to imtcp
• New Elastic Beats / Lumberjack input module via imbeats
• Ongoing defensive hardening across parsers, inputs, outputs, queues, TLS, and
  test coverage
• New POSIX FIFO input module via imfifo
• Per-source ratelimit policy handling shared across multiple inputs
• New RainerScript helpers: cbool(), tocef(), cef_ext_escape(), and
  parse_time_localtz()
• Improved queue, parser, TLS, Kafka, imfile, and output-action reliability

Headline: experimental stream compression

This release introduces experimental stream compression for TCP forwarding from
omfwd to imtcp.

The feature is aimed at high-traffic environments where bandwidth is a cost,
capacity, or resilience constraint. Compressing the rsyslog forwarding stream
can reduce network volume, support FINOPS goals, and help preserve available
bandwidth during traffic spikes or attack periods when log volume rises sharply.

omfwd can send compressed TCP streams with
compression.mode="stream:always", and imtcp can decompress matching streams
with zlib or zstd drivers on both sides. Receiver-side guardrails cover
expansion and per-receive decompression limits, and the feature ships with
impstats coverage, documentation, and RainerScript/YAML tests.

This is rsyslog stream compression, not TLS-native compression. Layering it with
TLS is supported by the new tests, but stream compression should still be
treated as experimental in 8.2606.0.

imptcp also gained stream:auto handling, allowing one listener to accept
both zlib-compressed and plain sessions. This can help staged rollouts where not
all forwarding clients switch at once.

New feature: imbeats input

imbeats adds Elastic Beats and Elastic Agent output.logstash ingestion via
Lumberjack v2.

The target audience is narrower than for stream compression, but important:
operators who want to use rsyslog inside Elastic-style pipelines for
performance, routing flexibility, enrichment, filtering, or to avoid total
vendor lock-in. The module accepts JSON event frames, compressed frames, and
cumulative acknowledgements over TCP or TLS, preserves the original JSON
payload, maps decoded fields into $!, and stores transport metadata under
$!metadata!imbeats.

The implementation includes bounds for frame, batch, window, decompressed
payload, and session limits, plus worker-based multiplexing so high client
counts do not require one thread per connection.

Defensive hardening and robustness

This release contains a large amount of defensive hardening and reliability
work. Some of it came from automated analysis, some from manual review, and
some from normal issue-driven maintenance. This is an ongoing project effort:
as automated exploitation and AI-assisted bug discovery become more common, we
are continuously tightening boundaries, parser behavior, cleanup paths, and
test oracles.

Notable examples include:

• mmjsonparse closes a bounded-scan trailing-data bypass in find-json mode.
• Embedded NUL bytes passed through C-string helper boundaries are now escaped
  instead of being silently truncated.
• mmdblookup preserves large unsigned 64-bit MaxMind DB values.
• Safe disk queue recovery now resets stale on-disk byte accounting.
• Transactional action queue batches interrupted during shutdown are re-enqueued
  instead of being dropped.
• imdocker multiline and rate-limit paths were hardened.
• imptcp, imtcp, TLS drivers, parser paths, template handling, and runtime
  message replacement received additional boundary and cleanup fixes.
• The testbench gained more deterministic checks and de-flaking work, though a
  small set of flakes remains under active investigation.

Other notable changes

Inputs, forwarding, and protocol handling

• imfifo adds line-oriented POSIX FIFO input support with dynamic
  non-blocking instances.
• imfile now delivers same-file monitors independently and can expose
  per-file line_number metadata.
• Deleted-file descriptor cleanup in imfile inotify mode was improved so
  disk space can be reclaimed after monitored files are removed.
• imkafka now supports multiple topics in one input instance.
• imjournal now diagnoses stalls caused by future-dated journal entries and
  improves recovery after journal invalidation.

Configuration, RainerScript, and templates

• New cbool(expr) helps render explicit JSON booleans through
  jsonf datatype="bool".
• New tocef() and cef_ext_escape() helpers simplify Common Event Format
  output.
• New parse_time_localtz() parses timestamps using local timezone semantics.
• parser.dropTrailingCROnReception can strip a final carriage return after
  normal LF handling.
• RainerScript now warns on constant boolean operands such as common
  $msg contains "a" or "b" mistakes.
• Negated exact priority filters such as local4.!=debug now match the
  documented priorities instead of accidentally matching nothing.
• Duplicate action names and dynstats bucket names now emit warnings.

Reliability and operational fixes

• omfwd TCP/TLS retry handling preserves retry state more reliably and avoids
  rebind cleanup leaks.
• omhttp retry-ruleset handling avoids self-stalls after short HTTP outages.
• omclickhouse now reports HTTP 400+ responses as data failures through
  normal diagnostics.
• omkafka improves reload serialization and DNS-failure suspension reporting.
• ommysql now handles closed MySQL connections before commit correctly.
• ompgsql accepts long cloud and Kubernetes-style server hostnames.
• mmpstrucdata supports custom structured-data containers and bounded parsed
  structured-data length.

TLS, portability, packaging, and CI

• wolfSSL-backed CRL and OCSP revocation checking is now supported through the
  OpenSSL compatibility driver.
• OpenSSL PermittedPeer wildcard matching now checks certificate identities
  consistently.
• omrelp can opt into suspending instead of permanently disabling an action
  on TLS authentication failure.
• Builds now honor cross pkg-config selection for libgcrypt.
• AIX builds are fixed for systems without BSD STAILQ macros.
• The ETL Vespa container configuration now defaults to HTTPS.
• CI and local validation gained Ubuntu 26.04 coverage, s390x/QEMU coverage,
  zizmor checks, and broader hardening/test relevance improvements.

Compatibility notes

• libyaml support is now an explicit configure feature. It remains enabled by
  default and must be satisfied by package builds unless --disable-libyaml is
  passed. This removes the previous auto-detection behavior where the presence
  or absence of libyaml development files silently changed the feature set.
• TCP stream compression is experimental in this release. It is rsyslog stream
  compression, not TLS-native compression. zlib/zstd driver choices must match
  across sender and receiver.
• parser.dropTrailingCROnReception defaults to off, preserving existing CR
  handling unless explicitly enabled.
• Duplicate action names and dynstats bucket names remain valid for
  compatibility, but now produce diagnostics.
• Configurations that accidentally relied on negated exact priority filters
  such as local4.!=debug matching nothing may now see the documented messages.
• RainerScript boolean expressions with constant operands now produce parser
  warnings. Existing syntax and truthiness behavior are unchanged.
• omelasticsearch now warns when the legacy searchType parameter is
  configured, because Elasticsearch mapping types are obsolete.
• omrelp keeps its default TLS authentication failure behavior. The new
  suspend-on-auth-failure behavior is opt-in via
  tls.permanentFailureDisablesAction="off".

Contributors

Thanks to everyone who contributed to this release, including:

• 0xseiryuu
• Attila Lakatos
• Billie Alsup
• Jacob
• Julien Thomas
• Juliusz Sosinowicz
• Jeremie Jourdin
• Midnya
• shinigami35
• Tamir Suliman
• Yury Bushmelev

All other changes were contributed by Adiscon GmbH.

Website announcement

https://www.rsyslog.com/rsyslog-8-2606-0-stream-compression-elastic-beats-input-and-ongoing-defensive-hardening/

Artifact availability

Source release artifacts are attached here.

Container images are available on Docker Hub:

• https://hub.docker.com/r/rsyslog/rsyslog
• https://hub.docker.com/r/rsyslog/rsyslog-minimal
• https://hub.docker.com/r/rsyslog/rsyslog-collector
• https://hub.docker.com/r/rsyslog/rsyslog-dockerlogs
• https://hub.docker.com/r/rsyslog/rsyslog-etl

OS packages are also built and available via the usual package channels. See
the rsyslog package installation docs and the scheduled-stable downloads page
for package locations:

• https://www.rsyslog.com/doc/installation/packages.html
• https://www.rsyslog.com/downloads/download-v8-stable/

Distribution packages may still appear with some delay after the release
announcement as downstream publishing completes.

Release assets

This release includes the maintainer-built rsyslog-*.tar.gz source tarball
produced by make dist.

These uploaded assets are the official source-release artifacts and are
distinct from GitHub's auto-generated source snapshots.