部署nginx+rsyslog补丁

nginx 配置:

user  nginx;
worker_processes  1;
syslog local5 nginx;

error_log   /var/log/nginx/nginx_error.log  crit;

pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

   #send the log to syslog and file.
        access_log  syslog:notice|logs/access.log main;

        # pre 1.5.x
        error_log syslog:notice|logs/error.log;

这样会把访问日志和错误日志都写入到local5 日志设备:

local{x} 日志设备的可用范围:

./configure --prefix=/usr/local/nginx --user=nginx --group=nginx --sbin-path=/usr/local/nginx/bin/nginx --conf-path=/etc/nginx/nginx.conf --pid-path=/var/run/nginx/nginx.pid --lock-

path=/var/lock/nginx.lock --error-log-path=/var/log/nginx/nginx_error.log --http-log-path=/var/log/nginx/nginx_access.log --with-http_ssl_module --with-http_flv_module --with-

http_stub_status_module --with-http_gzip_static_module --http-client-body-temp-path=/var/tmp/nginx/client/ --http-proxy-temp-path=/var/tmp/nginx/proxy --http-fastcgi-temp-path=/var/tmp/nginx/fcgi 

--http-uwsgi-temp-path=/var/tmp/nginx/uwsgi --http-scgi-temp-path=/var/tmp/nginx/scgi --with-pcre=/software/pcre_install/pcre-8.36 --with-zlib=/software/zlib_install/zlib-1.2.8 --with-

openssl=/software/openssl_install/openssl-1.0.2

jrhwpt01:/root/nginx-1.4.7# git clone https://github.com/splitice/nginx_syslog_patch
Initialized empty Git repository in /root/nginx-1.4.7/nginx_syslog_patch/.git/

jrhwpt01:/root/nginx-1.4.7#  patch -p1 </root/nginx-1.4.7/nginx_syslog_patch/syslog_1.4.0.patch
patching file src/core/ngx_cycle.c
patching file src/core/ngx_log.c
patching file src/core/ngx_log.h
patching file src/http/modules/ngx_http_log_module.c
patching file src/http/ngx_http_core_module.c
Hunk #2 succeeded at 4895 (offset 2 lines).
Hunk #3 succeeded at 4913 (offset 2 lines).
Hunk #4 succeeded at 4952 (offset 2 lines).
patching file src/http/ngx_http_request.c
Hunk #1 succeeded at 517 (offset -14 lines).
Hunk #2 succeeded at 798 (offset -23 lines).
Hunk #3 succeeded at 2002 (offset -23 lines).

重新编译:
jrhwpt01:/root/nginx-1.4.7# nginx -V
nginx version: nginx/1.4.7
built by gcc 4.4.7 20120313 (Red Hat 4.4.7-16) (GCC)
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --user=nginx --group=nginx --sbin-path=/usr/local/nginx/bin/nginx --conf-path=/etc/nginx/nginx.conf --pid-path=/var/run/nginx/nginx.pid --lock-

path=/var/lock/nginx.lock --error-log-path=/var/log/nginx/nginx_error.log --http-log-path=/var/log/nginx/nginx_access.log --with-http_ssl_module --with-http_flv_module --with-

http_stub_status_module --with-http_gzip_static_module --http-client-body-temp-path=/var/tmp/nginx/client/ --http-proxy-temp-path=/var/tmp/nginx/proxy --http-fastcgi-temp-path=/var/tmp/nginx/fcgi 

--http-uwsgi-temp-path=/var/tmp/nginx/uwsgi --http-scgi-temp-path=/var/tmp/nginx/scgi --with-pcre=/software/pcre_install/pcre-8.36 --with-zlib=/software/zlib_install/zlib-1.2.8 --with-

openssl=/software/openssl_install/openssl-1.0.2 --add-module=/root/nginx-1.4.7/nginx_syslog_patch/

配置nginx ：
user  nginx;
worker_processes  1;
syslog local5 nginx;
error_log   /var/log/nginx/nginx_error.log  crit;

pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    log_format  main  '$http_host $server_addr $remote_addr [$time_local] "$request" '
                     '$request_body $status $body_bytes_sent "$http_referer" "$http_user_agent" '
                     '$request_time $upstream_response_time';
      #send the log to syslog and file.
      access_log  syslog:notice|/var/log/nginx/access.log main;

      # pre 1.5.x
      error_log syslog:notice|/var/log/nginx/error.log;
    #access_log  logs/access.log  main;

访问日志和错误日志都输出到 local5日志设备

日志格式:
www.zjcap.cn 10.252.105.1x7 10.252.142.1x4 [05/Aug/2016:15:48:58 +0800] "GET /h5/activity/olympic/images/icon_horn.png HTTP/1.1" - 200 405 "https://www.zjcap.cn/h5/activity/olympic/index.html?

from=timeline&isappinstalled=0" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12B440 MicroMessenger/6.1.1 NetType/WIFI" 0.001 -