Configuration changes in Syslog-ng PE 8.0.0. Upgrading to Syslog-ng PE 8.0. (4378921)

Changes in Syslog-ng PE 8.0.0 require consideration before upgrading as they can impact functionality.

Please review the following changes to determine if they impact your current Syslog-ng PE configuration. 

Please test the installation of PE 8.0 before upgrading in production. 

# syslog-ng Premium Edition 8.0.0 changes

## syslog-ng aliases itself as syslog.socket

From PE 8.0.0, syslog-ng PE will alias itself as the syslog.socket service on Linux distributions that use systemd for service management. This behaviour might cause conflicts with other services registering themselves as the syslog.socket service (for example, rsyslog).

## Changes caused by OpenSSL upgrade

Algorithms using MD4 or SHA-1 are removed by default, so they are considered as not supported:

- MD4 hash

    For example, if you use MD4 hash in templates, syslog-ng sends the following error message during the configuration parsing:

    > MD4 hash function is not available starting with OpenSSL 3.0. in /opt/syslog-ng/etc/syslog-ng.conf

- Ciphersuite changes

    ECDHE-RSA-AES256-SHA uses SHA-1, which is now considered insecure.

    syslog-ng messages will inform you about other ciphers that the OpenSSL 3 upgrade might also affect. If you encounter any issues, check your certifications as well.

- Elliptic Curves

    Some curves like prime192v1 (also known as secp192r1) are deprecated and might be disabled by default due to their weak security in any upcoming OpenSSL 3.x version.

## TLS certificate no longer accepts invalid wildcard placement during hostname validation

From 8.0.0, syslog-ng PE will no longer accept anything that is non-compliant with the restrictions defined in RFC6125:

https://www.rfc-editor.org/rfc/rfc6125#section-6.4.3

For example, previously the following domain names were accepted inside a TLS certificate:

    example.*.com
    example.a*b.com

## Embedded format-json calls now return a JSON type instead of a string

Embedded format-json statements now return a JSON value, for example:

    "$(format-json inner_json=$(format-json test_value=\"test\"))"

This JSON value will be evaluated as:

    {"inner_json":{"test_value":"test"}}

To restore the previous value that returned a string, you can use type hinting, for example:

    "$(format-json inner_json=string($(format-json test_value=\"test\")))"

To get the original behaviour:

    {"inner_json":"{\"test_value\":\"test\"}"}

This is important in cases where the destination requires a string of a JSON instead of a JSON object. For example, in case of the JSON type for the Google BigQuery destination.

## format-json: spaces around = is now allowed

The following cases are now allowed when using the format-json function:

    $(format-json foo =value1)
    $(format-json foo= value1)
    $(format-json foo = value1)
    $(format-json foo=\" value1 \")
    $(format-json foo= \" value1 \")
    $(format-json foo1= value1 foo2 =value2 foo3 = value3 foo4 = \" value4 \" foo5=\"\")

Note the usage of the escaped strings like `\" value \"`, and the (escaped and) quoted form that uses an empty value `\"\"`. The second is a breaking change because previously an expression like `key= ` generated a JSON key-value pair with an empty value `{"key":""}`.

## Change in format of Python implementation based (driver, parsers, and so on) statistics

The format of the statistics has been changed and affects Python implementations.
Previously, the statistics key was the same as the automatically generated persist name by default, but now it resembles the Python class.

For example, in case of the following configuration:

    source s_google_pubsub_source {
        google_pubsub(
            credentials(<creds>)
            project(<project>)
            subscription(<sub>)
        );
    };

The old behavior generated the following:

    src.python;s_google_pubsub_source#0;python,pubsub.<project>.<sub>.1;*

The new behavior generates the following:

    src.python;s_google_pubsub_source#0;python,syslogngpe.google.pubsubsource.PubSubSource;*