3.2.5
	Mon, 31 Oct 2011 17:07:39 +0100

	Highlights:
	===========

	This is a bugfix oriented release to update the 3.2 version with the
	latest bugfixes. By all intents, this is the last maintenance
	release in the 3.2.x series, please consider upgrading to 3.3 in the
	nearfuture.

	Bugfixes:
	=========
        * Fixed support for systemd socket activation. Previously such
          sockets were not set to non-blocking mode, causing syslog-ng to
          hang.

	* Fixed support for chain-hostnames(). The marking of local messages
	  was broken, and as a result hostnames generated by
	  chain-hostnames(yes) got also broken: instead of
	  <source>@<hostname> <hostname>/<hostname> got generated.

	* Fixed a possible segmentation fault when using SSL and a
	  certificate with an X.509 extension specifying the policy which
	  the certificate is meant to be used.

	* Fixed a segmentation fault when applying regular expression (PCRE
	  or POSIX) to a read-only macro and enabling 'store-matches'.

	* Fixed support for changing the $PROGRAM value using rewrite rules
	  if 'store-legacy-msghdr' is in effect (the default). If the
	  PROGRAM value is ever changed, the MSGHDR macro will be
	  recalculated using the new value, effectively disabling the
	  'store-legacy-msghdr' behaviour.

	* Fixed the handling of negative timezone offsets, in case the
	  offset contains a half an hour.

	* Fixed a segmentation fault when an unknown source flag was
	  specified in the configuration file.

	* Fixed a failed assertion in case a log message grew over 255k. To
	  grow to this size, either the log_msg_size() option must be
          increased over this value or a lot of name-value pairs must be
	  used in the configuration to inflate the size of the internal
	  representation.

	* Fixed parsing AIX forwarded messages, which contains the hostname
	  in a special format.

	* Support the use of CAP_SYSLOG instead of CAP_SYS_ADMIN on recent
	  kernels and distributions.

	* The the O_CLOEXEC flag on the fds to child program pipes is set to
	  avoid inheriting those to other children of syslog-ng.

	* Fixed directory inclusion, hidden files (e.g. files starting with
	  a dot) are skipped when including a directory.

	* Support for RFC5424 SDATA blocks without an embedded parameter.

	* Fixed some minor memory leaks in the configuration file parser,
	  causing leaks when syslog-ng is reloaded.

	* Fixed support for block arguments with an empty default value.

	Other changes:
	==============
	* Added support for installing systemd unit files.

	* Added better detection for SQLite in the function test to only
	  start if everything is available.

	* AIX portability fix to load modules from .a files.

	Credits:
	========
        syslog-ng is developed as a community project, and as such it relies
        on volunteers to do the work necessarily to produce syslog-ng.

        Reporting bugs, testing changes, writing code or simply providing
        feedback are all important contributions, so please if you are a
        user of syslog-ng, contribute.

	These people have helped in this release:

          Balazs Scheidler (BalaBit)
          Enrico Scholz (Technische Universitat Chemnitz)
          Eric Duda
          Gergely Nagy (BalaBit)
          José Pedro Oliveira (Fedora)
          Lennart Poettering (RedHat)
          Pallagi Zoltan (BalaBit)
          Peter Czanik (BalaBit)
          Peter Eisenlohr
          Peter Gyorko (BalaBit)
          Remy Zandwijk

	Thanks for your efforts, it is appreciated.

3.2.4
	Thu, 05 May 2011 23:10:52 +0200

	Highlights:

	This maintenance release fixes some looser ends in the last
	published release, 3.2.3.  There's one more important bugfix here,
	which is triggered by PCRE newer than 8.12.

	Bugfixes:
	* Fixed build problems on Solaris & AIX.
	* A bug was found in the pcre implementation for subst(). If the
	  "global" flag is specified and pcre returns an error, an infinite
          loop is created, consuming memory in the process. It is triggered
	  by PCRE 8.12, but could potentially affect older versions too.
	* Fixed a potential use of uninitialized memory in the configuration
	  file parser, no bug was triggered but gcc 4.6 reported it via a
	  warning.

	Other changes:
	* Fixed most (but not all) compilation warnings when compiling with
	  gcc 4.6

	Credits:

	syslog-ng is developed as a community project, and as such it relies
	on volunteers, to do the work necessarily to produce syslog-ng.

	Reporting bugs, testing changes, writing code or simply providing
	feedback are all important contributions, so please if you are a
	user of syslog-ng, contribute.

	These people have helped in this release:

	  Sandor Geller (Morgan Stanley)
	  Balazs Scheidler (BalaBit)
	  Micah Anderson
	  Jose Oliveira (Fedora)

	Thanks for your efforts, it is appreciated.

3.2.3
	Sun, 01 May 2011 19:05:32 +0200

	Highlights:

	This is a maintenance release for the 3.2 branch, which contains
	several important functionality fixes in the db-parser()
	correllation code, an important security fix for FreeBSD & HP-UX
	(CVE-2011-0343) and build fixes for cygwin and mixed mode linking.

	Security fixes:
        * Fixed a possible security issue on Debian/kFreeBSD and on
          platforms where mode_t is an unsigned 16 bit value (FreeBSD,
          HP-UX).  On these platforms syslog-ng may be using 0xFFFF as the
          permission bits.  (CVE-2011-0343)

	Bugfixes:
	* Fixes an y2k38 problem that causes syslog-ng to use 100% CPU time
	  in case mark messages are enabled and the UNIX timestamps
	  overflows a signed 32 bit counter, which happens in 19th, January 2038
	* Fixed file() destination to work on device nodes (e.g. files in
	  /dev).  Without this change, syslog-ng started using 100% CPU time
	  if given devices as destinations that couldn't always consume
	  data.
	* The code to restore the last file position for source files will
	  not accept file-position past the file size, and will restart the
	  file from the beginning instead.
	* Don't attempt to remember the current file position for source
	  files that are read with follow-freq(0), e.g. /dev/klog and
	  /proc/kmsg. These are special files which do not have the notion
	  of file position, so no need to remember them. Regular files
	  should always be read with follow-freq() set to nonzero, which is
	  the default.
	* Fixed linking unit tests and other tools in mixed linking mode.
	* Fixed compilation on cygwin, especially lot of efforts went into
	  linker compatibility.
	* Fixed building on platforms where PCRE is not in the standard
	  include path.
	* Accept catch-all flag on log statements as well as catchall, as
	  this was incorrectly documented in the past.

	db-parser() & pdbtool bugfixes:
	* Fixed @XX style message reference parsing used in correllation
	  rules.
	* Fixed a segfault in the $(grep) template function when processing
	  the parameters failed.
	* Fixed segfault in "pdbtool match --debug-pattern" in case the
	  pattern doesn't match.
	* Fixed "pdbtool test" as previously all patterndb.xml files were
	  reported to be invalid, even valid ones.
	* Fixed correllation timer related issue that caused some timers not
	  to expire in rare cases.

	db-parser() & pdbtool changes:
	* Added support for enclosing template function arguments in
	  parenthesis, in which case the quotes within the parentheses are
	  not removed. For example: $(grep ('$FACILITY' == 'syslog'))
	  This makes writing $(grep) and $(if) arguments much easier.
	* dbparser() the @NUMBER@ and @FLOAT@ parsers are able to parse
	  negative numbers.
	* Added debug messages to dbparser() correllation so that it becomes
	  easier to diagnose db-parser() problems.
	* Added -d (for --debug) and -v (for --verbose) options to pdbtool
	  in order to make patterndb debugging easier.
	* Added --no-parse option to "pdbtool patternize" in order to read
	  files without syslog-style parsing.

	Other changes:
	* Added error messages on DBI initialization failures.
	* Added systemd socket activation support.

	Build related changes:
	* Support for old (e.g. pre 7.1 commonly found in RHEL5) PCRE
	  versions at the cost of an inoperating "newline" regexp flag.
	* configure now validates flex/bison versions better, as the
	  requirements are more strict starting with syslog-ng 3.2
	* Drop the creation of libsyslog-ng-patterndb.so.
	* "make clean" will properly remove libafsocket.so symlink.

	Credits:

	syslog-ng is developed as a community project. All changes and
	improvements requires effort, and this effort is really appreciated.

	Writing code, testing changes or simply providing use-cases and
	information on one's setup will make syslog-ng better.

	Here are the people, listed in no specific order who made this
	release possible.

          Steven Chamberlain
          Roger
          Paul Krizak (AMD)
          Attila Szalay (BalaBit)
          Matthew Hall
          Marius Tomaschewski (SUSE)
          Gergely Nagy (BalaBit)
          Tom Gundersen
          Dalibor Toman (Fortech.cz)
          Corinna Vinschen (RedHat)
          Balazs Scheidler (BalaBit)
          Laszlo Boszormenyi (LSC.hu)
          Arkadiusz Miśkiewicz (PLD Linux)
          Valentijn Sessink
          Hendrik Visage
          Peter Gyongyosi (BalaBit)
          Zoltan Pallagi (BalaBit)
          Mishou Michael (US IRS)

	Thanks for their efforts, it is appreciated.

3.2.2
	Sat, 15 Jan 2011 13:50:35 +0100

	Bugfixes:
        * Fixed a possible segmentation fault when the port number is
          changed for a TCP source, the configuration is reloaded and there
          were open connections for the old port, which send messages after
          the SIGHUP. This behaviour has been broken since 3.0.1.
        * Fixed a possible security issue on FreeBSD and on
          platforms where mode_t is an unsigned 16 bit value. On these
          platforms syslog-ng may be using 0xFFFF as the permission bits
          causing log files to be world readable/writable/executable/setuid.
	* Fixed leaking the contents of internal() messages (such as MARK or
	  the statistics message).
	* Fixed current time tracking when calculating the time in the
	  correllation engine.
	* When the patterndb file got reloaded the correllation state was
	  dropped. This behaviour was fixed.
	* Really ignore invalid persist-state files, which caused syslog-ng
	  startup to fail previously.
	* Added the missing support for blocks inside log {} statements. 
	* Fixed a configuration init error when the same db-parser()
	  instance is referenced from multiple log paths.
        * Fixed handling the port() options for SQL destinations.

	Platform specific:
	* Added cygwin support to the system() source.

	Build related:
	* syslog-ng modules are now linked with "-module -no-undefined"
	  parameters, pdbtool and unit tests are using -dlpreopen when
	  explicitly linking against such modules.
	* The core patterndb functionality got split off to a separate
	  library installed to $libdir to make it easier to be used by
	  pdbtool.
	* Fixed support for an explicit --exec-prefix configure parameter.
	  Earlier if exec_prefix was different from prefix, the installation
	  layout produced unworkable binaries.
	* If no OpenSSL libraries are available, pdbtool patternize still
	  can work, although in this case proper UUID generation is not
	  possible.
	* If syslog-ng is compiled against an old glib (earlier than 2.13),
	  it'll not use an API that is present in newer ones. Please note
	  however that there might be other similar compatibility issues
	  with old Glib versions.
	* Updated cygwin packaging files.
	* Don't use -wno-pointer-sign in dbparser if gcc doesn't support it.
	  This will emit a lot of warnings, but still make the code possible
	  to compile with older gcc versions.

	Credits:

	syslog-ng is developed as a community project. All changes and
	improvements requires effort, and this effort is really appreciated.

	Writing code, testing changes or simply providing use-cases and
	information on one's setup will make syslog-ng better.

	Here are the people, listed in no specific order who made this
	release possible.

	  * Balázs Németh (BalaBit)
	  * Sándor Gellér (Morgan Stanley)
	  * Péter Czanik (BalaBit)
	  * Owen Mann (Interactive Data)
	  * Zhengxiang Pan (Alcatel Lucent)
	  * Corinna Vinschen (RedHat)
	  * Eric Berggren (Apple)
	  * Gergely Nagy (BalaBit)
	  * Matthew Hall
	  * LEBRETON Philippe
	  * Craig Bell
	  * Steven Chamberlain
	  * Balázs Scheidler (BalaBit)

	Thanks for their efforts, it is appreciated.

3.2.1
	Tue, 23 Nov 2010 08:59:47 +0100

	This is the first release of the new major version of syslog-ng,
	dubbed 3.2.

	There are far-reaching changes in this release, the summary of the
	new features is the longest list ever since the first syslog-ng
	release in 1998.

	db-parser():
	============
	* Added support for message correllation in db-parser. See the
	  relevant blog posts for more information:

	  http://bazsi.blogs.balabit.com/2010/10/syslog-ng-correllation-updated/
	  http://bazsi.blogs.balabit.com/2010/09/syslog-ng-correllation/

	* Added "pdbtool patternize", which implements automatic patterndb
	  generation from a sample log file.

	  http://gyp.blogs.balabit.com/2010/01/introducing-pdbtool-patternize/

	* Added pdbtool validation support, using the "pdbtool test --validate". 
          Requires an installed xmllint program.

	* pdbtool is now able to merge patterndb XML files recursively in
	  order to make it easy to use the results of the patterndb project.

	* db-parser() automatically assigns class-specific tags to messages,
	  this means that a message classified "system" will get a
	  ".classifier.system" tag in addition to storing the class in a
	  name-value pair named ${.classifier.class}

	* It is now possible to use multiple program name patterns for a
	  single ruleset in patterndb.

	* pdbtool match is now able to read a file containing syslog
	  messages and apply patterndb and a filter expression on the
          contents.

          http://bazsi.blogs.balabit.com/2010/07/patterndb-grep-on-steroids.html

	* pdbtool test is now able to perform pattern testing automatically
	  based on the supplied example log message.

	  http://marci.blogs.balabit.com/2010/07/pdbtool-test-and-pattern-database.html

	Message model:
	==============
	* Added template functions framework and some initial functions:

          http://bazsi.blogs.balabit.com/2010/09/introducing-template-functions/

	  The new functions are: $(echo), $(grep) and $(if)

	* Added support for comparison operators in filter expressions, e.g.
	  it is now possible to use "$FACILITY_NUM" < "5". String and
	  numeric operators are also provided, the same way as in perl.

	* Added $(ipv4-to-int) template function to convert an IP address to
	  its numeric representation.

	* It is now possible to supply a filter to rewrite expressions and
	  only apply the rewrite rule in case the filter matches.

	  https://lists.balabit.hu/pipermail/syslog-ng/2010-July/014565.html

	Architecture:
	=============
	* Plugins: the new architecture replaces the old monolithic one,
	  all syslog-ng functionality is loaded from external plugins when
          needed. It is possible to write plugins to extend syslog-ng
          functionality in the following areas:
            - sources
            - destinations
            - filter expression
            - parsers
            - rewrite ops
	    - message format

          http://bazsi.blogs.balabit.com/2010/04/syslog-ng-32-changes.html
          http://bazsi.blogs.balabit.com/2010/07/syslog-ng-contributions-redefined.html

	* The framework for a "syslog-ng configuration library" (aka SCL) a
	  collection of configuration snippets installed along syslog-ng,
	  simplifying the authoring of syslog-ng configuration files.

          http://git.balabit.hu/?p=bazsi/syslog-ng-3.2.git;a=commit;h=287993339599deac0442e26355c600b5aee63583
          http://bazsi.blogs.balabit.com/2010/07/syslog-ng-contributions-redefined.html

	* Support for reusable configuration snippets, similar to macros
	  with parameters, named "blocks".

          http://bazsi.blogs.balabit.com/2010/04/syslog-ng-32-opened-experimental-blocks.html

	* Added a confgen plugin that includes the output of a program into
	  the configuration file, making it possible to generate
          configuration file snippets dynamically.

          http://git.balabit.hu/?p=bazsi/syslog-ng-3.2.git;a=commit;h=5248ef6c49ff3af0b3c896448360073606c9c7d7

	Compatibility:
	==============
	* Added support to process native syslog.conf file using the
	  syslogconf SCL plugin.

	  http://bazsi.blogs.balabit.com/2010/09/syslog-ng-now-supports-the-syslog-conf-file-format/

	* syslog-ng now automatically detects if an incoming message is in
	  RFC3164 or RFC5424 format. This means that the syslog driver can
	  be used to process both.

	New sources:
	* Support for BSD-style process accounting logs via the pacct()
	  source driver defined in by SCL and the underlying pacctformat
	  plugin.

          http://bazsi.blogs.balabit.com/2010/07/syslog-ng-and-process-accounting.html

	SQL driver enhancements:
	========================
	* Support for explicit COMMITs in the SQL driver, this speeds up SQL
	  INSERT rate significantly if flush_lines() is non-zero.

          http://bazsi.blogs.balabit.com/2010/04/explicit-transaction-support-in-sql.html

	Other changes:
	==============
	* Persistent state containing the current file position for file
	  sources is now continously updated during runtime, instead of
          updating it only at exit, which makes it much more reliable in
          case syslog-ng doesn't terminate normally.

        * Better syntax error reporting in the configuration file.

	  http://bazsi.blogs.balabit.com/2010/04/syslog-ng-32-changes.html

	* It is now possible to use multiple parser expressions in a single
	  parser object, similar to rewrite rules.

	* Added support for using the include statement from anywhere in the
	  configuration file, instead of only at top-level. Also introduced
          syslog-ng "global values" that can be defined and the substituted
          anywhere in the configuration file.

          http://git.balabit.hu/?p=bazsi/syslog-ng-3.2.git;a=commit;h=1203267c465256c99e622edf11e226301170f1c7
          http://git.balabit.hu/?p=bazsi/syslog-ng-3.2.git;a=commit;h=52098762f27cde059e8b8ecda67691df85364e6d

	* Default configuration file supplied as part of SCL.

	Incompatible changes:
	=====================
	* syslog-ng traditionally expected an optional hostname field even
	  when a syslog message is received on a local transport (e.g.
	  /dev/log).  However no UNIX version is known to include this
	  field. This caused problems when the application creating the log
	  message has a space in its program name field.  This behaviour has
	  been changed for the unix-stream/unix-dgram/pipe drivers if the
	  config version is 3.2 and can be restored by using an explicit
	  'expect-hostname' flag for the specific source.

	Compared to 3.2beta1:
	=====================

	Bugfixes:
	* Fixed Linux capability support for unix-stream() and file()
	  destinations (Zbigniew Krzystolik)
	* Fixed segmentation faults in "pdbtool match" reported by Peter
	  Czanik.
	* Fixed pdbtool match --debug-pattern to correctly display &
	  colorize its output.
	* Fixed negated tags() filtering.
	* The hostname wasn't always properly NUL terminated, causing binary
	  garbage to get into the logs in case chain_hostnames() option 
          is used.
	* Fixed signed/unsigned comparison problem in db-parser() pattern
	  matching, possibly causing the db-parser() to mismatch on utf8 data.
	* The db-parser() correllation state is kept accross SIGHUPs.

	Other changes:
	* Added man pages for loggen, syslog-ng-ctl. Updated man pages for
	  all other commands. (Robert Fekete)
	* Removed the requirement to use UUIDs in patterndb files.
	* The Debian packaging built into the source now builds a pluginised
	  syslog-ng binary correctly.
	* The correllation engine now also follows system time to cause
	  pending events to time out even if there's no incoming log traffic.
	* When using "pdbtool match" with correllation, pending events
	  accumulated until the end of the file are all run automatically.
	* Added patterndb v4 XML schema.
	
3.2beta1
	Mon, 11 Oct 2010 12:25:07 +0200

	Changes and new features destined to the syslog-ng 3.2 release are
	complete, and starting with this release, only bugfixes and minor
	changes are possible. There's only one exception to this: the
	correllation framework in db-parser() is still considered
	experimental and is recommended for early adopters only.

	This beta has gone through some testing and initial blocker problems
	were fixed before the release. Right now I'm not aware of any
	serious issues, but as always, testing is appreciated.

	New features since 3.2alpha2:

	Bugfixes since 3.2alpha2:
	* Fixed a possible infinite loop in "pdbtool test" in case
	  program/message was missing from the sample message.

	* SQL: revert don't require the current CVS version of libdbi

	* Don't report "this config file version is too old" multiple times.

	* Underscore and dash are assumed to be equivalent in plugin names.

	* Various memory leaks were plugged.

	Removed functions:
	* Removed the use_time_recvd() global and per-destination option,
	  deprecated since 3.0. Can be substituted with $R_ prefix in macro
	  names.

	Other changes:
	* Restructured the source tree in order to make compilations of
	  independent plugins easier and faster. Modules go to modules/
	  subdirectory, the core lives under lib/ and the main executables
	  go into syslog-ng/

	* SCL paths are determined relative to ${datadir} instead of
	  ${prefix} to make distribution packaging easier.

	* Pass -avoid-version when linking modules.

	* syslog-ng now requires bison 2.4, this is also checked by the
	  configure script.

3.2alpha2
	Fri, 06 Aug 2010 21:17:50 +0200

	The documentation of syslog-ng is not yet up-to-date with the new
        features introduced with this release.  Therefore for each feature
        below you can also find an URL containining the best known
        description what the given feature does.  These are not necessarily
        100% accurate, but should give anyone interested an idea how to
        start experimenting.

	Also, please note that although this is an alpha release, the bulk
        of the changes are in the configuration parser, so once your
        configuration was parsed properly and syslog-ng starts up, an almost
        unchanged code is processing it.  This means that this release
        should be good enough to start playing with.  And feedback about
        what kind of syslog-ng.conf parsing errors you encounter on
        real-life configuration files is more than welcome.

	New features:

3.2alpha1
	Wed, 14 Jul 2010 21:25:19 +0200

	Initial 3.2 release. NEWS will be filled in later.
