Czanik@BalaBit

As co-maintainer of syslog-ng for openSUSE, I started preparations for the syslog-ng 3.3 release. This is due to a major change in syslog-ng: it is becoming multi-threaded, bringing a performance boost to an already fast application. While I and many others use it on production machines, be aware, that this is still an alpha release. Packages are available for openSUSE 11.3, 11.4 and Factory. If you have a chance, please try it and share your experiences!

First of all: what’s new? The major improvement is multithreading, bringing a performance boost to multi-core / multi-cpu machines. Mongodb support is also added for NoSQL fans, systemd support and also a global suppress() option. For more details, please check: http://bazsi.blogs.balabit.com/2011/03/the-2nd-alpha-for-syslog-ng-3-3-is-released/

My syslog-ng 3.3 packages were prepared in the openSUSE build service at https://build.opensuse.org/project/show?project=home%3Aczanik%3Asyslog-ng33 For those, who are not yet familiar with the OBS: it’s the build infrastructure behind the openSUSE distribution and many other distributions and software projects. Details at https://build.opensuse.org/

The packages are available at http://download.opensuse.org/repositories/home:/czanik:/syslog-ng33/ in the respective sub-directories. The sample config has threading enabled by default. The new syslog-ng release also needs a new eventlog version, which is also included there. As openSUSE 11.3 does not have libdbi, SQL support is not available for openSUSE 11.3, the other two packages have an SQL add-on package. OpenSUSE 11.3 also has an older AppArmor version, which does not let syslog-ng to start. One can disable it (rcapparmor stop), disable only syslog-ng (aa-complain sbin.syslog-ng) or use the profile from openSUSE 11.4.

One can download the necessary packages from the above location, or can also use zypper for installation. First add a new installation source:

zypper -v ar -f http://download.opensuse.org/repositories/home:/czanik:/syslog-ng33/openSUSE_11.4/ czp_syslogng

The example is for openSUSE 11.4, you should change the directory name according to your openSUSE version. Then install eventlog 0.2.12. This will be fixed in the future (I’ll soon submit a new eventlog package to factory too), but now needs to be done by hand (other way an old version is installed).

zypper -v in libevtlog0

If you already had an old version installed, it will complain because of the repo change. In this case copy & paste the command as printed on screen.

Finally install syslog-ng and the optional sql support package:

zypper -v in syslog-ng

zypper -v in syslog-ng-sql

Please share your experiences with syslog-ng 3.3 alpha2 either here or on the syslog-ng mailing list at https://lists.balabit.hu/mailman/listinfo/syslog-ng