...
- The opEvents processing pipeline has been updated to perform more actions in parallel for improved performance.
All input parsing and event (action) processing is now handled in separate independent processes, and all log entries are suitably prefixed to identify the active party.
New config optionsopeventsd_queue_cycle
andopeventsd_file_cycle
control how often these processes check for pending work. - Inbound log processing was made more robust wrt. file rotatation and now also handles logfiles that are growing faster than opEvents can consume data; suitable warning log messages are created if such a situation is detected.
- All automatic opEvents daemon restarting is now subject to exponential backoff to limit the system load. In this version it is also possible to configure the opEvents daemon to not restart when configuration files are changed; see config option
opeventsd_restart_on_config_change
inopCommon.nmis
for details. - The log verbosity of opEvents' daemon processes can now be changed dynamically without restarting:
If you send any of the daemons the signalUSR1
, then that daemon will increase its logging verbosity by one step. SignalUSR2
decreases the verbosity.
Dynamically set verbosity levels do not persist across daemon restarts. - opEvents can now optionally keep consumed JSON event inputs in an archive directory, instead of deleting them after consumption.
See the config optionopevents_move_json_logs
inopCommon.nmis
for details.
The processing order of JSON event inputs was also adjusted to simplify debugging. - Event actions of type
script
whose handler programs crash are now retried a limited number of times only, andopevents_max_action_queue_age
is checked for such retries. - Flap detection is now more consistent wrt. the delayed action time window, and a suitable warning is logged if an event is too old for the flap detection logic to perform reliably.
- opEvents now offers configurable Flap Event naming; see config option
opevents_flap_name
inopCommon.nmis
for details. - It is now possible (but not recommended) to disable all DNS use in opEvents.
- If desired, opEvents can be configured to not product Raw Log entries for blacklisted inputs. The default choice is to raw-log such inputs, but see config option
raw_log_black_list
inopCommon.nmis
for other options. Raw Log data in general was made more consistent and complete, regardless of type of event input.
...