0.3.0 strengthens the integrity of the audit trail: the product decides what is discarded when a queue is full, every loss is reported, and every error is named. VxWorks 6.4 joins the supported platforms.
An audit trail is only evidence if its gaps are known. Every device meets conditions under which it cannot deliver every record: a burst of events during a network outage, a storage medium beginning to fail, a collector that has gone away. IEC 62443-4-2 requires, under CR 2.10, that a component can respond appropriately to such failures of audit processing, and leaves the choice of response to the product.
SolidSyslog 0.3.0 makes that response a single, explicit product decision. When a queue is full, the library asks one function of yours whether to discard the oldest records, the newest, or to halt delivery until the policy changes. The buffer and the store share the policy, so it applies whether or not the product has local storage, and it is consulted at the moment of decision, so it can change on a running device. Previously only the store carried a policy, fixed at configuration. Whatever is discarded is reported, and the gap is visible at the collector.
What is improved
Loss is reported once, and shows at the collector. The buffers, the store, the senders and the logger each report when a run of losses begins, rather than for every record, so an error handler is not flooded during the event it is reporting. The sequence number carried in each record shows the collector where the gap lies.
A failing store does not interrupt delivery. The first failed operation on the storage device freezes the store, reported once, and delivery to the collector continues without it. A stored record that fails verification is discarded and reported, and those behind it are delivered; one whose key is not yet available is retained until it can be checked.
Errors are named. Every error event carries the name of its severity, category and detail, and where a platform call failed, the platform’s own code: the errno or the file-system result. A service log reads the same on every platform, without a lookup table.
Sent means delivered to the network. On several embedded stacks a UDP datagram to an unresolved address is accepted and then dropped while the next hop is looked up. A datagram is now reported sent only once the next hop is resolved, and one that cannot be resolved fails, and is reported. No stream accepts a record after the collector has closed the connection, every TCP connect is bounded at five minutes, and a transport refuses to be opened twice.
VxWorks 6.4
0.3.0 is the first release to include the VxWorks 6.4 platform. The post on the port describes the work; the platform page records what has been built and run. The reference platforms now number fourteen: POSIX, Windows, C11 atomics, OpenSSL, Mbed TLS, lwIP raw and sockets APIs, FreeRTOS-Plus-TCP, FreeRTOS, CMSIS-RTOS2, VxWorks 6.4, FatFs, FreeRTOS-Plus-FAT and LittleFS.
Standards and assurance
By our own assessment SolidSyslog continues to meet every applicable clause of RFC 5424, 5425, 5426 and 6587; the compliance matrix holds the evidence. Before release, every documentation page was read against the code and nine behaviours questioned; each is corrected or confirmed as designed. Every limitation recorded against 0.2.0 is resolved, and no defect is open at this release.
Footprint
On the worked example, the first compliant record is about 7.2 KB of flash and 2.5 KB of RAM. The complete path, with pinned TLS, certificate renewal, mutual TLS and encryption at rest, is about 22.6 KB of flash and 36.3 KB of RAM, measured on the running target. Flash is about 6 KB more than 0.2.0, spent where failures are now handled rather than ignored; RAM is unchanged. The hardening path states the cost of each stage.
Moving from 0.2.0
This is a 0.x release and the API changes. The release notes list every change under Before you upgrade. Both worked examples, CMake and GNU Make, have 0.3.0 releases rebuilt one commit per stage. One default has changed: a full ring buffer now discards its oldest records, where 0.2.0 refused the newest; a policy answering Newest restores the previous behaviour.
The release carries a signed offline copy of its documentation, a signed software bill of materials and a signed source-tree hash, so a technical file can hold exactly what was shipped.
Next
Further 0.x releases will follow before 1.0.0 in Q4 2026. Any organisation can evaluate SolidSyslog free under the PolyForm Internal Use licence, with no time limit. Start from the product page or contact us about your product.
