-
Title
Configuration changes in Syslog-ng PE 8.0.0. Upgrading to Syslog-ng PE 8.0. -
Description
Changes in Syslog-ng PE 8.0.0 require consideration before upgrading as they can impact functionality.
-
Cause
Please review the following changes to determine if they impact your current Syslog-ng PE configuration.
Please test the installation of PE 8.0 before upgrading in production.
-
Resolution
# syslog-ng Premium Edition 8.0.0 changes
## syslog-ng aliases itself as syslog.socket
From PE 8.0.0, syslog-ng PE will alias itself as the syslog.socket service on Linux distributions that use systemd for service management. This behaviour might cause conflicts with other services registering themselves as the syslog.socket service (for example, rsyslog).
## Changes caused by OpenSSL upgrade
Algorithms using MD4 or SHA-1 are removed by default, so they are considered as not supported:
- MD4 hash
For example, if you use MD4 hash in templates, syslog-ng sends the following error message during the configuration parsing:
> MD4 hash function is not available starting with OpenSSL 3.0. in /opt/syslog-ng/etc/syslog-ng.conf
- Ciphersuite changes
ECDHE-RSA-AES256-SHA uses SHA-1, which is now considered insecure.
syslog-ng messages will inform you about other ciphers that the OpenSSL 3 upgrade might also affect. If you encounter any issues, check your certifications as well.
- Elliptic Curves
Some curves like prime192v1 (also known as secp192r1) are deprecated and might be disabled by default due to their weak security in any upcoming OpenSSL 3.x version.
## TLS certificate no longer accepts invalid wildcard placement during hostname validation
From 8.0.0, syslog-ng PE will no longer accept anything that is non-compliant with the restrictions defined in RFC6125:
https://www.rfc-editor.org/rfc/rfc6125#section-6.4.3
For example, previously the following domain names were accepted inside a TLS certificate:
example.*.com
example.a*b.com## Embedded format-json calls now return a JSON type instead of a string
Embedded format-json statements now return a JSON value, for example:
"$(format-json inner_json=$(format-json test_value=\"test\"))"
This JSON value will be evaluated as:
{"inner_json":{"test_value":"test"}}
To restore the previous value that returned a string, you can use type hinting, for example:
"$(format-json inner_json=string($(format-json test_value=\"test\")))"
To get the original behaviour:
{"inner_json":"{\"test_value\":\"test\"}"}
This is important in cases where the destination requires a string of a JSON instead of a JSON object. For example, in case of the JSON type for the Google BigQuery destination.
## format-json: spaces around = is now allowed
The following cases are now allowed when using the format-json function:
$(format-json foo =value1)
$(format-json foo= value1)
$(format-json foo = value1)
$(format-json foo=\" value1 \")
$(format-json foo= \" value1 \")
$(format-json foo1= value1 foo2 =value2 foo3 = value3 foo4 = \" value4 \" foo5=\"\")Note the usage of the escaped strings like `\" value \"`, and the (escaped and) quoted form that uses an empty value `\"\"`. The second is a breaking change because previously an expression like `key= ` generated a JSON key-value pair with an empty value `{"key":""}`.
## Change in format of Python implementation based (driver, parsers, and so on) statistics
The format of the statistics has been changed and affects Python implementations.
Previously, the statistics key was the same as the automatically generated persist name by default, but now it resembles the Python class.For example, in case of the following configuration:
source s_google_pubsub_source {
google_pubsub(
credentials(<creds>)
project(<project>)
subscription(<sub>)
);
};The old behavior generated the following:
src.python;s_google_pubsub_source#0;python,pubsub.<project>.<sub>.1;*
The new behavior generates the following:
src.python;s_google_pubsub_source#0;python,syslogngpe.google.pubsubsource.PubSubSource;*