liblognorm 1.0.0 released

Thursday, November 28th, 2013

We have just released liblognorm 1.0.0. This is a completely revamped and enhanced version. It introduces incompatible API changes, which were unavoidable. For details please visit


Version 1.0.0, 2013-11-28

  • WARNING: this version has incompatible interface and older programs will not compile with it.
    For details see
  • libestr is not used any more in interface functions. Traditional C strings are used instead. Internally, libestr is still used, but scheduled for removal.
  • libee is not used any more. JSON-C is used for object handling instead. Parsers and formatters are now part of liblognorm.
  • added new field type “rest”, which simply sinks all up to end of the string.
  • added support for glueing two fields together, without literal between them. It allows for constructs like:
    which matches string “1000Kbps”
  • Fix incorrect merging of trees with empty literal at end
    Thanks to Pavel Levshin for the patch
  • this version has survived many bugfixes



As always, feedback is appreciated.

Best regards,
Florian Riedl

liblognorm 1.0.0

Thursday, November 28th, 2013

Download file name: liblognorm 1.0.0

liblognorm 1.0.0
sha256 hash: 01f73c735fd7291c2f1041518f4d005a8100e6be33f07eab00d4f27d1c1934de

Author: Rainer Gerhards (
Version: 1.0.0 File size: 0.349 MB

Download this file now!

On liblognorm 1.0.0

Thursday, November 28th, 2013

Liblognorm is a fast-samples based normalization library. It’s brand new version 1.0.0 will be released today. It is a major improvement over previous versions, but unfortunately we needed to change the API. So some notes are due.

Liblognorm evolves since several years and was intially meant to be used primarily with the Mitre CEE effort. Consequently, the initial version of liblognorm (0.x) uses the libee CEE support library in its API.

As time evolved, the initial CEE schema underwent considerable change. Even worse, Mitre lost funding for CEE. While the CEE ideas survived as part of Red Hat-driven “Project Lumberjack”, the data structures became greatly simplified and JSON based. That effectively made libee obsolete (and also in parts libestr, which was specifically written to support CEE’s initial requirement of embedded NUL chars in strings).

Recently, Pavel Levshin converted liblognorm to native JSON, which helped improve performance and simplicity for many client applications. Unfortunately, this change broke interface compatibility (and there was no way to avoid that, obviously…).

The current library is the result of that effort. Application developers are encouraged to switch to this version, as it provides the benefit of a simpler API. This version is now being tracked by the git master branch.

However, if you need to stick to the old API, there is a git branch liblognorm0, which contains the previous version of the library. This branch is also maintained for important bug fixes, so it is safe to use.

We recommend that packagers create packages both for liblognorm0 and liblognorm1. Note that liblognorm’s development packages cannot coexist on the same system as the PKGCONFIG system would get into trouble. Adiscon’s own packages follow this schema.

Note that rsyslog will soon begin to enjoy the benefits of liblognorm1. This resulst in a notable performance improvement for mmnormalize. Support will initially become available in v8.