Page History

...

• The opEvents processing pipeline has been updated to perform more actions in parallel for improved performance.
  All input parsing and event (action) processing is now handled in separate independent processes, and all log entries are suitably prefixed to identify the active party.
  New config options opeventsd_queue_cycle and opeventsd_file_cycle control how often these processes check for pending work.
• Inbound log processing was made more robust wrt. file rotatation and  now also handles logfiles that are growing faster than opEvents can consume data; suitable warning log messages are created if such a situation is detected.
• All automatic opEvents daemon restarting  is now subject to exponential backoff to limit the system load. In this version it is also possible to configure the opEvents daemon to not restart when configuration files are changed; see config option opeventsd_restart_on_config_change in opCommon.nmis for details.
• The log verbosity of opEvents' daemon processes can now be changed dynamically without restarting:
  If you send any of the daemons the signal USR1, then that daemon will increase its logging verbosity by one step. Signal USR2 decreases the verbosity.
  Dynamically set verbosity levels do not persist across daemon restarts.
• opEvents can now optionally keep consumed JSON event inputs in an archive directory, instead of deleting them after consumption.
  See the config option opevents_move_json_logs in opCommon.nmis for details.
  The processing order of JSON event inputs was also adjusted to simplify debugging.
• Event actions of type script whose handler programs crash are now retried a limited number of times only, and opevents_max_action_queue_age is checked  for such retries.
• Flap detection is now more consistent wrt. the delayed action time window, and a suitable warning is logged if an event is too old for the flap detection logic to perform reliably.
• opEvents now offers configurable Flap Event naming; see config option opevents_flap_name in opCommon.nmis for details.
• It is now possible (but not recommended) to disable all DNS use in opEvents.
• If desired, opEvents can be configured to not product Raw Log entries for blacklisted inputs. The default choice is to raw-log such inputs, but see config option raw_log_black_list in opCommon.nmis for other options. Raw Log data in general was made more consistent and complete, regardless of type of event input.

...