解决rsyslog 断电或者被kill 重发问题

$InputFilePersistStateInterval 1

Specifies how often the state file shall be written when processing the input file. The default value is 0, which means a new state file is only written when the monitored files is being closed 

(end of rsyslogd execution). Any other value n means that the state file is written every time n file lines have been processed. This setting can be used to guard against message duplication due to 

fatal errors (like power fail). Note that this setting affects imfile performance, especially when set to a low value. Frequently writing the state file is very time consuming.

应用发送端:
uat-web02:/var/log/nginx# cat scan.log
dadadatest
uat-web02:/var/log/nginx# echo "dadadatest" >>scan.log
You have new mail in /var/spool/mail/root
uat-web02:/var/log/nginx# echo "1111111111111" >>scan.log
uat-web02:/var/log/nginx# echo "2222222222222" >>scan.log
uat-web02:/var/log/nginx# ps -ef | grep rsyslog
root     23550     1  0 14:50 ?        00:00:00 /sbin/rsyslogd -i /var/run/syslogd.pid
root     23576 22786  0 14:50 pts/1    00:00:00 grep rsyslog
uat-web02:/var/log/nginx# kill -9 23550
uat-web02:/var/log/nginx# ps -ef | grep rsyslog
root     23578 22786  0 14:50 pts/1    00:00:00 grep rsyslog
uat-web02:/var/log/nginx# service rsyslog start
Starting system logger:                                    [  OK  ]
uat-web02:/var/log/nginx# cat scan.log
dadadatest
dadadatest
1111111111111
2222222222222
You have new mail in /var/spool/mail/root

rsyslog 接收端:
zjtest7-frontend:/data/scan# cat scan.2016-10-10
 dadadatest
 1111111111111
 2222222222222
zjtest7-frontend:/data/scan# cat scan.2016-10-10
 dadadatest
 1111111111111
 2222222222222
 dadadatest
 dadadatest
 1111111111111
 2222222222222

看到当kill后,会重发

解决:
input(type="imfile"
File="/var/log/nginx/scan.log"
Tag="uat-scan"
Severity="info"
PersistStateInterval="1"
Facility="local5")