WinSyslog 7.0 Final (Build Service 7.0.0.430/Client 7.0.0.316)

• x64 Build.

  – This is the first Version which introduces WinSyslog on the x64 platform. Major compatibility changes for the x64 platform have been made in the Service core. For details see the changes listed below:- ODBC Database Action, fully runs on x64 now. Please note that there are currently very few ODBC drivers for x64 available!

  – Configuration Registry Access, a DWORD Value will now be saved as QWORD into the registry. However the Configuration Client and Win32 Service Build can handle these data type and convert these values automatically into DWORD if needed. The Configuration Client will remain a win32 application. Only the Service has been ported to the x64 platform.

A note on cross updates from Win32 to x64 Edition of WinSyslog!

It is not possible to update directly from Win32 to x64 Edition using setup upgrade method. The problem is that a minor upgrade will NOT install all the needed x64 components. Only a full install will be able to do this. Therefore, in order to perform an cross update, follow these instructions:

1. Create a backup of your configuration, save it as registry or xml file (See the Configuration Client Computer Menu)
2. Uninstall WinSyslog.
3. Install WinSyslog by using the x64 Edition of the setup.
4. Import your old settings from the registry or xml file.

• New Action: OLEDB Database Action

  – This is another major feature enhancement. Due the changes to x64, it became more important to also support the newer database layer from Microsoft called OLEDB. The OLEDB Action works similar to the ODBC Action from configuration point of few. The MS SQL OLEDB Provider and JET4.0 OLEDB Provider have been successfully tested in the Win32 environment. Unfortunately, the JET4.0 Provider has not been ported to the x64 platform yet. In our internal performance tests, there was an enhancement of up to 30% compared to ODBC. So this action may also be interesting for people with a huge amount of incoming data.

• Engine Enhancements

  – The default Queue count has been changed from infinite to 200000 items. However you can still change it back to infinite by setting it to zero.- Added retry logic into the RuleEngine. If enabled, the Service retries Actions on failure (until the retry counter is reached). Note that the Event error 114 will only be written if the last retry failed, previous error’s will only be logged in the debug log (With the error facility).

  – Added new additional handling for low-memory cases. The Service allocates some emergency memory on startup. If the system memory limit is reached, it releases the emergency memory and locks the queue. That means no more items can be queued. This prevents a crash of the Service and the queue is still being processed. Many other positions in the code have been hardened against out of memory sceneries.

  – Compiled engine with new OpenSSL Version ( 0.9.8a ) and created updated DLL files.

  – Important Engine Enhancement! The Action processing engine has been multithread enabled, which means that the overall processing performance will increase in larger environments and Service will benefit from SMP machines.

  – Improved string handling with large strings like binary data from an Eventlog entry.

  – Added SIGNAL handler for the console mode of the Service. This means if you run the Service in console mode and press CTRL+C, the Service will terminate as it would have been stopped using the Windows SCM (ServiceControlManager).

• Property Engine

  – Added a new Option for time related properties. Within the properties, all time is based on UTC regardless if your preferred time is UTC or localtime. So if you want to display localtime instead of UTC, you have to use the following syntax: %variable:::localtime%- Property Replacer, Enhanced the property replacer so that now the ToPos can also contain a seach expression. The syntax is the same as in FromPos, Example: %msg:/start/$:/end/%. This will return the text between the strings “start” and “end” (where “end” is only searched in the string after “start”.

• WriteFile Action

  – Optimized filename generation, which is now cached if possible.- Removed a hard coded minimum limit of 2 files when circular logging was enabled. This makes it possible to have a file rolled over when it has reached a specific size.

• ODBC Database Action

  – Added more diagnostic debug output which is useful for troubleshooting.

• SNMP Receiver

  – Enterprise SNMP Traps were not correctly processed and variables resolved, this has been fixed now.- There exist a problem with some SNMP Devices and the internal NETSNMP variable resolving function. The enhanced (Fully resolve Mibnames) method has been fixed and resolves this Mibnames correctly now. If you experience any Problem, enable this Option in your SNMP Receiver.

• ODBC Database Action

  – Fixed a bug with the property inserts (If the value was above 256 bytes) which caused the insert statements to fail if MS Access was used as database.

  – If a connection is broken, the Service gracefully shutdowns the DB Connection and tries to reopen the Connection with the next InfoUnit. However a bug has been fixed in this shutdown code that aborted the shutdown and caused further problems with the Action.

• Send Email Action

  – Fixed a bug which could occur if a connection was closed after the session timeout. In very seldom cases, this could have caused an access violation.

• Core Engine

  – Fixed a problem that lead to inoperative service if an invalid InfoUnit type was detected. Now, invalid InfoUnit’s are simply ignored.- Fixed a few minor bugs in the Shutdown process, but nothing which is important for the running service process.

  – Implemented the new LibLogging Version ( 0.6.0 ). In previous versions changing the listening port from 601 to any other in RFC3195 format does not take affect. This is fixed now.

• Configuration Client

  – Fixed a bug in the FilterView, the comments of filters were not copied if a rule was cloned.- Fixed a bug in the CallRuleSet Action Form, the RuleSetName was not saved on initial creation of such an action.